diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/qml/jsruntime/qv4dataview.cpp | 2 | ||||
| -rw-r--r-- | src/quick/items/qquickrepeater.cpp | 6 |
2 files changed, 7 insertions, 1 deletions
diff --git a/src/qml/jsruntime/qv4dataview.cpp b/src/qml/jsruntime/qv4dataview.cpp index 5ab8cf2dcb..da1b91e69a 100644 --- a/src/qml/jsruntime/qv4dataview.cpp +++ b/src/qml/jsruntime/qv4dataview.cpp @@ -92,7 +92,7 @@ ReturnedValue DataViewCtor::virtualCallAsConstructor(const FunctionObject *f, co uint byteLength = (argc < 3 || argv[2].isUndefined()) ? (bufferLength - offset) : ::toIndex(scope.engine, argv[2]); if (scope.hasException()) return Encode::undefined(); - if (offset + byteLength > bufferLength) + if (offset > bufferLength || byteLength > bufferLength - offset) return scope.engine->throwRangeError(QStringLiteral("DataView: constructor arguments out of range")); Scoped<DataView> a(scope, scope.engine->memoryManager->allocate<DataView>()); diff --git a/src/quick/items/qquickrepeater.cpp b/src/quick/items/qquickrepeater.cpp index 20603720c5..6dc735d20b 100644 --- a/src/quick/items/qquickrepeater.cpp +++ b/src/quick/items/qquickrepeater.cpp @@ -417,6 +417,12 @@ void QQuickRepeater::createdItem(int index, QObject *) void QQuickRepeater::initItem(int index, QObject *object) { Q_D(QQuickRepeater); + if (index >= d->deletables.size()) { + // this can happen when Package is used + // calling regenerate does too much work, all we need is to call resize + // so that d->deletables[index] = item below works + d->deletables.resize(d->model->count() + 1); + } QQuickItem *item = qmlobject_cast<QQuickItem*>(object); if (!d->deletables.at(index)) { |