2 files changed, 36 insertions, 0 deletions
diff --git a/tests/auto/qml/qqmlecmascript/data/generatorCrashNewProperty.qml b/tests/auto/qml/qqmlecmascript/data/generatorCrashNewProperty.qml
new file mode 100644
index 0000000000..f775b4c613
--- /dev/null
+++ b/tests/auto/qml/qqmlecmascript/data/generatorCrashNewProperty.qml
@@ -0,0 +1,20 @@
+// QTBUG-91491
+import QtQml 2.15
+
+QtObject {
+   property int a: 42
+   property int b: 0
+   property int c: 0
+
+   function f(myfunc) {
+      let gen = myfunc();
+      gen["u"] = 0 // Adding members to the generator used to cause crashes when calling next()
+      c = gen.next().value
+   }
+
+   function refreshA() {
+      f(function*() { b = 12; return a });
+   }
+
+   Component.onCompleted: refreshA();
+}
diff --git a/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp b/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp
index 775026de2e..1ac1c04fd4 100644
--- a/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp
+++ b/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp
@@ -243,6 +243,7 @@ private slots:
     void eval();
     void function();
     void topLevelGeneratorFunction();
+    void generatorCrashNewProperty();
     void qtbug_10696();
     void qtbug_11606();
     void qtbug_11600();
@@ -6494,6 +6495,21 @@ void tst_qqmlecmascript::topLevelGeneratorFunction()
     QCOMPARE(it.property("next").callWithInstance(it).property("value").toInt(), 1);
 }
 
+// QTBUG-91491
+void tst_qqmlecmascript::generatorCrashNewProperty()
+{
+    QQmlEngine engine;
+    QQmlComponent component(&engine, testFileUrl("generatorCrashNewProperty.qml"));
+
+    QScopedPointer<QObject> o(component.create());
+
+    QVERIFY2(o != nullptr, qPrintable(component.errorString()));
+
+    QCOMPARE(o->property("a").toInt(), 42);
+    QCOMPARE(o->property("b").toInt(), 12);
+    QCOMPARE(o->property("c").toInt(), 42);
+}
+
 // Test the "Qt.include" method
 void tst_qqmlecmascript::include()
 {