Fix crash in QDeclarativePropertyMap.

Task-number: QTBUG-9439

3 files changed, 25 insertions, 6 deletions

diff --git a/src/declarative/util/qdeclarativeopenmetaobject.cpp b/src/declarative/util/qdeclarativeopenmetaobject.cpp
index 70ecf95..6611885 100644
--- a/src/declarative/util/qdeclarativeopenmetaobject.cpp
+++ b/src/declarative/util/qdeclarativeopenmetaobject.cpp
@@ -222,7 +222,7 @@ int QDeclarativeOpenMetaObject::metaCall(QMetaObject::Call c, int id, void **a)
             propertyRead(propId);
             *reinterpret_cast<QVariant *>(a[0]) = d->getData(propId);
         } else if (c == QMetaObject::WriteProperty) {
-            if (d->data[propId].first != *reinterpret_cast<QVariant *>(a[0]))  {
+            if (propId <= d->data.count() || d->data[propId].first != *reinterpret_cast<QVariant *>(a[0]))  {
                 propertyWrite(propId);
                 d->writeData(propId, *reinterpret_cast<QVariant *>(a[0]));
                 propertyWritten(propId);
diff --git a/src/declarative/util/qdeclarativepropertymap.cpp b/src/declarative/util/qdeclarativepropertymap.cpp
index d3e1d7c..0bdd91b 100644
--- a/src/declarative/util/qdeclarativepropertymap.cpp
+++ b/src/declarative/util/qdeclarativepropertymap.cpp
@@ -41,6 +41,7 @@
 
 #include "qdeclarativepropertymap.h"
 
+#include <private/qmetaobjectbuilder_p.h>
 #include "qdeclarativeopenmetaobject_p.h"
 
 #include <QDebug>
@@ -56,6 +57,7 @@ public:
 
 protected:
     virtual void propertyWritten(int index);
+    virtual void propertyCreated(int, QMetaPropertyBuilder &);
 
 private:
     QDeclarativePropertyMap *map;
@@ -88,6 +90,11 @@ void QDeclarativePropertyMapMetaObject::propertyWritten(int index)
     priv->emitChanged(QString::fromUtf8(name(index)), operator[](index));
 }
 
+void QDeclarativePropertyMapMetaObject::propertyCreated(int, QMetaPropertyBuilder &b)
+{
+    priv->keys.append(QString::fromUtf8(b.name()));
+}
+
 /*!
     \class QDeclarativePropertyMap
     \since 4.7
@@ -172,8 +179,6 @@ QVariant QDeclarativePropertyMap::value(const QString &key) const
 void QDeclarativePropertyMap::insert(const QString &key, const QVariant &value)
 {
     Q_D(QDeclarativePropertyMap);
-    if (!d->keys.contains(key))
-        d->keys.append(key);
     d->mo->setValue(key.toUtf8(), value);
 }
 
@@ -249,10 +254,8 @@ QVariant &QDeclarativePropertyMap::operator[](const QString &key)
     //### optimize
     Q_D(QDeclarativePropertyMap);
     QByteArray utf8key = key.toUtf8();
-    if (!d->keys.contains(key)) {
-        d->keys.append(key);
+    if (!d->keys.contains(key))
         d->mo->setValue(utf8key, QVariant());   //force creation -- needed below
-    }
 
     return (*(d->mo))[utf8key];
 }
diff --git a/tests/auto/declarative/qdeclarativepropertymap/tst_qdeclarativepropertymap.cpp b/tests/auto/declarative/qdeclarativepropertymap/tst_qdeclarativepropertymap.cpp
index d23de43..c996a14 100644
--- a/tests/auto/declarative/qdeclarativepropertymap/tst_qdeclarativepropertymap.cpp
+++ b/tests/auto/declarative/qdeclarativepropertymap/tst_qdeclarativepropertymap.cpp
@@ -59,6 +59,8 @@ private slots:
     void clear();
     void changed();
     void count();
+
+    void crashBug();
 };
 
 void tst_QDeclarativePropertyMap::insert()
@@ -168,6 +170,20 @@ void tst_QDeclarativePropertyMap::count()
     QCOMPARE(map.size(), map.count());
 }
 
+void tst_QDeclarativePropertyMap::crashBug()
+{
+    QDeclarativePropertyMap map;
+
+    QDeclarativeEngine engine;
+    QDeclarativeContext context(&engine);
+    context.setContextProperty("map", &map);
+
+    QDeclarativeComponent c(&engine);
+    c.setData("import Qt 4.6\nBinding { target: map; property: \"myProp\"; value: 10 + 23 }",QUrl());
+    QObject *obj = c.create(&context);
+    delete obj;
+}
+
 QTEST_MAIN(tst_QDeclarativePropertyMap)
 
 #include "tst_qdeclarativepropertymap.moc"