4 files changed, 60 insertions, 0 deletions
diff --git a/tests/auto/qml/qjsengine/tst_qjsengine.cpp b/tests/auto/qml/qjsengine/tst_qjsengine.cpp
index c66e2dccf3..363070d7f8 100644
--- a/tests/auto/qml/qjsengine/tst_qjsengine.cpp
+++ b/tests/auto/qml/qjsengine/tst_qjsengine.cpp
@@ -260,6 +260,7 @@ private slots:
     void sortNonStringArray();
     void iterateInvalidProxy();
     void applyOnHugeArray();
+    void reflectApplyOnHugeArray();
 
     void tostringRecursionCheck();
     void arrayIncludesWithLargeArray();
@@ -5174,6 +5175,22 @@ void tst_QJSEngine::applyOnHugeArray()
     QCOMPARE(value.toString(), "RangeError: Array too large for apply().");
 }
 
+
+void tst_QJSEngine::reflectApplyOnHugeArray()
+{
+    QQmlEngine engine;
+    const QJSValue value = engine.evaluate(R"(
+(function(){
+const v1 = [];
+const v3 = [];
+v3.length = 3900000000;
+Reflect.apply(v1.reverse,v1,v3);
+})()
+    )");
+    QVERIFY(value.isError());
+    QCOMPARE(value.toString(), QLatin1String("RangeError: Invalid array length."));
+}
+
 void tst_QJSEngine::typedArraySet()
 {
     QJSEngine engine;
diff --git a/tests/auto/qml/qqmllanguage/data/alias.15a.qml b/tests/auto/qml/qqmllanguage/data/alias.15a.qml
index ba8097c997..b5f96e15c1 100644
--- a/tests/auto/qml/qqmllanguage/data/alias.15a.qml
+++ b/tests/auto/qml/qqmllanguage/data/alias.15a.qml
@@ -9,4 +9,25 @@ Item {
     Item {
         id: symbol
     }
+
+    Rectangle {
+        id: txtElevationValue
+
+        property Rectangle background: Rectangle { }
+
+        state: "ValidatorInvalid"
+
+        states: [
+            State {
+                name: "ValidatorInvalid"
+                PropertyChanges {
+                    target: txtElevationValue
+                    background.border.color: "red" // this line caused the segfault in qtbug107795
+                }
+            },
+            State {
+                name: "ValidatorAcceptable"
+            }
+        ]
+    }
 }
diff --git a/tests/auto/qml/qqmllanguage/data/badGroupedProperty.qml b/tests/auto/qml/qqmllanguage/data/badGroupedProperty.qml
new file mode 100644
index 0000000000..34dcbf96fa
--- /dev/null
+++ b/tests/auto/qml/qqmllanguage/data/badGroupedProperty.qml
@@ -0,0 +1,10 @@
+import QtQml 2.15
+
+QtObject {
+    id: testItem
+    property rect rect
+    onComplete {
+        rect.x: 2
+        rect.width: 22
+    }
+}
diff --git a/tests/auto/qml/qqmllanguage/tst_qqmllanguage.cpp b/tests/auto/qml/qqmllanguage/tst_qqmllanguage.cpp
index 1be1533b63..ac6634290a 100644
--- a/tests/auto/qml/qqmllanguage/tst_qqmllanguage.cpp
+++ b/tests/auto/qml/qqmllanguage/tst_qqmllanguage.cpp
@@ -341,6 +341,7 @@ private slots:
     void ambiguousContainingType();
     void staticConstexprMembers();
     void bindingAliasToComponentUrl();
+    void badGroupedProperty();
 
 private:
     QQmlEngine engine;
@@ -5939,6 +5940,17 @@ void tst_qqmllanguage::bindingAliasToComponentUrl()
     }
 }
 
+void tst_qqmllanguage::badGroupedProperty()
+{
+    QQmlEngine engine;
+    const QUrl url = testFileUrl("badGroupedProperty.qml");
+    QQmlComponent c(&engine, url);
+    QVERIFY(c.isError());
+    QCOMPARE(c.errorString(),
+             QStringLiteral("%1:6 Cannot assign to non-existent property \"onComplete\"\n")
+             .arg(url.toString()));
+}
+
 QTEST_MAIN(tst_qqmllanguage)
 
 #include "tst_qqmllanguage.moc"