Make Qt exception safer.

Squashed commit of the branch haralds-haralds-qt-s60-topics/topic/exceptions,
which also contains the full history.

Rev-By: Harald Fernengel
Rev-By: Ralf Engels

26 files changed, 869 insertions, 457 deletions

diff --git a/src/corelib/tools/qbitarray.cpp b/src/corelib/tools/qbitarray.cpp
index a947ab5..7168a9a 100644
--- a/src/corelib/tools/qbitarray.cpp
+++ b/src/corelib/tools/qbitarray.cpp
@@ -209,6 +209,8 @@ void QBitArray::resize(int size)
         uchar* c = reinterpret_cast<uchar*>(d.data());
         if (size > (s << 3))
             memset(c + s, 0, d.size() - s);
+        else if ( size % 8)
+            *(c+1+size/8) &= (1 << (size%8)) - 1;
         *c = d.size()*8 - size;
     }
 }
diff --git a/src/corelib/tools/qbytearray.cpp b/src/corelib/tools/qbytearray.cpp
index 6aa35f3..ae6561f 100644
--- a/src/corelib/tools/qbytearray.cpp
+++ b/src/corelib/tools/qbytearray.cpp
@@ -1233,14 +1233,11 @@ QByteArray::QByteArray(const char *str)
     } else {
         int len = qstrlen(str);
         d = static_cast<Data *>(qMalloc(sizeof(Data)+len));
-        if (!d) {
-            d = &shared_null;
-        } else {
-            d->ref = 0;;
-            d->alloc = d->size = len;
-            d->data = d->array;
-            memcpy(d->array, str, len+1); // include null terminator
-        }
+        Q_CHECK_PTR(d);
+        d->ref = 0;;
+        d->alloc = d->size = len;
+        d->data = d->array;
+        memcpy(d->array, str, len+1); // include null terminator
     }
     d->ref.ref();
 }
@@ -1264,15 +1261,12 @@ QByteArray::QByteArray(const char *data, int size)
         d = &shared_empty;
     } else {
         d = static_cast<Data *>(qMalloc(sizeof(Data) + size));
-        if (!d) {
-            d = &shared_null;
-        } else {
-            d->ref = 0;
-            d->alloc = d->size = size;
-            d->data = d->array;
-            memcpy(d->array, data, size);
-            d->array[size] = '\0';
-        }
+        Q_CHECK_PTR(d);
+        d->ref = 0;
+        d->alloc = d->size = size;
+        d->data = d->array;
+        memcpy(d->array, data, size);
+        d->array[size] = '\0';
     }
     d->ref.ref();
 }
@@ -1290,15 +1284,12 @@ QByteArray::QByteArray(int size, char ch)
         d = &shared_null;
     } else {
         d = static_cast<Data *>(qMalloc(sizeof(Data)+size));
-        if (!d) {
-            d = &shared_null;
-        } else {
-            d->ref = 0;
-            d->alloc = d->size = size;
-            d->data = d->array;
-            d->array[size] = '\0';
-            memset(d->array, ch, size);
-        }
+        Q_CHECK_PTR(d);
+        d->ref = 0;
+        d->alloc = d->size = size;
+        d->data = d->array;
+        d->array[size] = '\0';
+        memset(d->array, ch, size);
     }
     d->ref.ref();
 }
@@ -1334,8 +1325,7 @@ void QByteArray::resize(int size)
         //    QByteArray a(sz);
         //
         Data *x = static_cast<Data *>(qMalloc(sizeof(Data)+size));
-        if (!x)
-            return;
+        Q_CHECK_PTR(x);
         x->ref = 1;
         x->alloc = x->size = size;
         x->data = x->array;
@@ -1377,8 +1367,7 @@ void QByteArray::realloc(int alloc)
 {
     if (d->ref != 1 || d->data != d->array) {
         Data *x = static_cast<Data *>(qMalloc(sizeof(Data) + alloc));
-        if (!x)
-            return;
+        Q_CHECK_PTR(x);
         x->size = qMin(alloc, d->size);
         ::memcpy(x->array, d->data, x->size);
         x->array[x->size] = '\0';
@@ -1390,8 +1379,7 @@ void QByteArray::realloc(int alloc)
         d = x;
     } else {
         Data *x = static_cast<Data *>(qRealloc(d, sizeof(Data) + alloc));
-        if (!x)
-            return;
+        Q_CHECK_PTR(x);
         x->alloc = alloc;
         x->data = x->array;
         d = x;
@@ -1812,11 +1800,13 @@ QByteArray &QByteArray::replace(const char *before, int bsize, const char *after
     const char *b = before;
     if (after >= d->data && after < d->data + d->size) {
         char *copy = (char *)malloc(asize);
+        Q_CHECK_PTR(copy);
         memcpy(copy, after, asize);
         a = copy;
     }
     if (before >= d->data && before < d->data + d->size) {
         char *copy = (char *)malloc(bsize);
+        Q_CHECK_PTR(copy);
         memcpy(copy, before, bsize);
         b = copy;
     }
@@ -3738,6 +3728,7 @@ QByteArray QByteArray::number(double n, char f, int prec)
 QByteArray QByteArray::fromRawData(const char *data, int size)
 {
     Data *x = static_cast<Data *>(qMalloc(sizeof(Data)));
+    Q_CHECK_PTR(x);
     if (data) {
         x->data = const_cast<char *>(data);
     } else {
diff --git a/src/corelib/tools/qdatetime.cpp b/src/corelib/tools/qdatetime.cpp
index 781514c..b43891c 100644
--- a/src/corelib/tools/qdatetime.cpp
+++ b/src/corelib/tools/qdatetime.cpp
@@ -2200,8 +2200,8 @@ int QTime::elapsed() const
     \sa isValid()
 */
 QDateTime::QDateTime()
+    : d(new QDateTimePrivate)
 {
-    d = new QDateTimePrivate;
 }
 
 
@@ -2211,8 +2211,8 @@ QDateTime::QDateTime()
 */
 
 QDateTime::QDateTime(const QDate &date)
+    : d(new QDateTimePrivate)
 {
-    d = new QDateTimePrivate;
     d->date = date;
     d->time = QTime(0, 0, 0);
 }
@@ -2225,8 +2225,8 @@ QDateTime::QDateTime(const QDate &date)
 */
 
 QDateTime::QDateTime(const QDate &date, const QTime &time, Qt::TimeSpec spec)
+    : d(new QDateTimePrivate)
 {
-    d = new QDateTimePrivate;
     d->date = date;
     d->time = date.isValid() && !time.isValid() ? QTime(0, 0, 0) : time;
     d->spec = (spec == Qt::UTC) ? QDateTimePrivate::UTC : QDateTimePrivate::LocalUnknown;
@@ -2237,8 +2237,8 @@ QDateTime::QDateTime(const QDate &date, const QTime &time, Qt::TimeSpec spec)
 */
 
 QDateTime::QDateTime(const QDateTime &other)
+    : d(other.d.data())
 {
-    d = other.d;
     d->ref.ref();
 }
 
@@ -2247,8 +2247,6 @@ QDateTime::QDateTime(const QDateTime &other)
 */
 QDateTime::~QDateTime()
 {
-    if (!d->ref.deref())
-        delete d;
 }
 
 /*!
@@ -2258,7 +2256,7 @@ QDateTime::~QDateTime()
 
 QDateTime &QDateTime::operator=(const QDateTime &other)
 {
-    qAtomicAssign(d, other.d);
+    d.assign(other.d.data());
     return *this;
 }
 
@@ -3298,7 +3296,7 @@ QDateTime QDateTime::fromString(const QString &string, const QString &format)
  */
 void QDateTime::detach()
 {
-    qAtomicDetach(d);
+    d.detach();
 }
 
 /*****************************************************************************
diff --git a/src/corelib/tools/qdatetime.h b/src/corelib/tools/qdatetime.h
index 3278297..cf4246d 100644
--- a/src/corelib/tools/qdatetime.h
+++ b/src/corelib/tools/qdatetime.h
@@ -44,6 +44,7 @@
 
 #include <QtCore/qstring.h>
 #include <QtCore/qnamespace.h>
+#include <QtCore/qscopedpointer.h>
 
 QT_BEGIN_HEADER
 
@@ -284,7 +285,7 @@ public:
 private:
     friend class QDateTimePrivate;
     void detach();
-    QDateTimePrivate *d;
+    QScopedSharedPointer<QDateTimePrivate> d;
 
 #ifndef QT_NO_DATASTREAM
     friend Q_CORE_EXPORT QDataStream &operator<<(QDataStream &, const QDateTime &);
diff --git a/src/corelib/tools/qharfbuzz.cpp b/src/corelib/tools/qharfbuzz.cpp
index 1940209..923eda4 100644
--- a/src/corelib/tools/qharfbuzz.cpp
+++ b/src/corelib/tools/qharfbuzz.cpp
@@ -126,6 +126,7 @@ char *HB_TextCodec_ConvertFromUnicode(void *codec, const HB_UChar16 *unicode, hb
     QByteArray data = reinterpret_cast<QTextCodec *>(codec)->fromUnicode((const QChar *)unicode, length);
     // ### suboptimal
     char *output = (char *)malloc(data.length() + 1);
+    Q_CHECK_PTR(output);
     memcpy(output, data.constData(), data.length() + 1);
     if (outputLength)
         *outputLength = data.length();
diff --git a/src/corelib/tools/qhash.cpp b/src/corelib/tools/qhash.cpp
index 2313e0e..a703621 100644
--- a/src/corelib/tools/qhash.cpp
+++ b/src/corelib/tools/qhash.cpp
@@ -171,7 +171,9 @@ QHashData QHashData::shared_null = {
 
 void *QHashData::allocateNode()
 {
-    return qMalloc(nodeSize);
+    void *ptr = qMalloc(nodeSize);
+    Q_CHECK_PTR(ptr);
+    return ptr;
 }
 
 void QHashData::freeNode(void *node)
@@ -181,6 +183,13 @@ void QHashData::freeNode(void *node)
 
 QHashData *QHashData::detach_helper(void (*node_duplicate)(Node *, void *), int nodeSize)
 {
+    return detach_helper( node_duplicate, 0, nodeSize );
+}
+
+QHashData *QHashData::detach_helper(void (*node_duplicate)(Node *, void *),
+        void (*node_delete)(Node *),
+        int nodeSize)
+{
     union {
         QHashData *d;
         Node *e;
@@ -197,18 +206,43 @@ QHashData *QHashData::detach_helper(void (*node_duplicate)(Node *, void *), int
     d->sharable = true;
 
     if (numBuckets) {
-        d->buckets = new Node *[numBuckets];
+        QT_TRY {
+            d->buckets = new Node *[numBuckets];
+        } QT_CATCH(...) {
+            // restore a consistent state for d
+            d->numBuckets = 0;
+            // roll back
+            d->free_helper(node_delete);
+            QT_RETHROW;
+        }
+
         Node *this_e = reinterpret_cast<Node *>(this);
         for (int i = 0; i < numBuckets; ++i) {
             Node **nextNode = &d->buckets[i];
             Node *oldNode = buckets[i];
             while (oldNode != this_e) {
-                Node *dup = static_cast<Node *>(allocateNode());
-                node_duplicate(oldNode, dup);
-                dup->h = oldNode->h;
-                *nextNode = dup;
-                nextNode = &dup->next;
-                oldNode = oldNode->next;
+                QT_TRY {
+                    Node *dup = static_cast<Node *>(allocateNode());
+
+                    QT_TRY {
+                        node_duplicate(oldNode, dup);
+                    } QT_CATCH(...) {
+                        freeNode( dup );
+                        QT_RETHROW;
+                    }
+
+                    dup->h = oldNode->h;
+                    *nextNode = dup;
+                    nextNode = &dup->next;
+                    oldNode = oldNode->next;
+                } QT_CATCH(...) {
+                    // restore a consistent state for d
+                    *nextNode = e;
+                    d->numBuckets = i+1;
+                    // roll back
+                    d->free_helper(node_delete);
+                    QT_RETHROW;
+                }
             }
             *nextNode = e;
         }
@@ -216,6 +250,26 @@ QHashData *QHashData::detach_helper(void (*node_duplicate)(Node *, void *), int
     return d;
 }
 
+void QHashData::free_helper(void (*node_delete)(Node *))
+{
+    if (node_delete) {
+        Node *this_e = reinterpret_cast<Node *>(this);
+        Node **bucket = reinterpret_cast<Node **>(this->buckets);
+
+        int n = numBuckets;
+        while (n--) {
+            Node *cur = *bucket++;
+            while (cur != this_e) {
+                Node *next = cur->next;
+                node_delete(cur);
+                cur = next;
+            }
+        }
+    }
+    delete [] buckets;
+    delete this;
+}
+
 QHashData::Node *QHashData::nextNode(Node *node)
 {
     union {
@@ -298,9 +352,10 @@ void QHashData::rehash(int hint)
         Node **oldBuckets = buckets;
         int oldNumBuckets = numBuckets;
 
+        int nb = primeForNumBits(hint);
+        buckets = new Node *[nb];
         numBits = hint;
-        numBuckets = primeForNumBits(hint);
-        buckets = new Node *[numBuckets];
+        numBuckets = nb;
         for (int i = 0; i < numBuckets; ++i)
             buckets[i] = e;
 
@@ -327,8 +382,7 @@ void QHashData::rehash(int hint)
 
 void QHashData::destroyAndFree()
 {
-    delete [] buckets;
-    delete this;
+    free_helper(0);
 }
 
 #ifdef QT_QHASH_DEBUG
diff --git a/src/corelib/tools/qhash.h b/src/corelib/tools/qhash.h
index 41b4794..b3f82e9 100644
--- a/src/corelib/tools/qhash.h
+++ b/src/corelib/tools/qhash.h
@@ -129,12 +129,15 @@ struct Q_CORE_EXPORT QHashData
 
     void *allocateNode();
     void freeNode(void *node);
-    QHashData *detach_helper(void (*node_duplicate)(Node *, void *), int nodeSize);
+    QHashData *detach_helper(void (*node_duplicate)(Node *, void *), int nodeSize); // ### Qt5 remove me
+    QHashData *detach_helper(void (*node_duplicate)(Node *, void *), void (*node_delete)(Node *),
+            int nodeSize);
     void mightGrow();
     bool willGrow();
     void hasShrunk();
     void rehash(int hint);
-    void destroyAndFree();
+    void free_helper(void (*node_delete)(Node *));
+    void destroyAndFree(); // ### Qt5 remove me
     Node *firstNode();
 #ifdef QT_QHASH_DEBUG
     void dump();
@@ -476,21 +479,30 @@ private:
     Node **findNode(const Key &key, uint *hp = 0) const;
     Node *createNode(uint h, const Key &key, const T &value, Node **nextNode);
     void deleteNode(Node *node);
+    static void deleteNode(QHashData::Node *node);
 
     static void duplicateNode(QHashData::Node *originalNode, void *newNode);
 };
 
+
 template <class Key, class T>
 Q_INLINE_TEMPLATE void QHash<Key, T>::deleteNode(Node *node)
 {
+    deleteNode(reinterpret_cast<QHashData::Node*>(node));
+}
+
+
+template <class Key, class T>
+Q_INLINE_TEMPLATE void QHash<Key, T>::deleteNode(QHashData::Node *node)
+{
 #ifdef Q_CC_BOR
-    node->~QHashNode<Key, T>();
+    concrete(node)->~QHashNode<Key, T>();
 #elif defined(QT_NO_PARTIAL_TEMPLATE_SPECIALIZATION)
-    node->~QHashNode();
+    concrete(node)->~QHashNode();
 #else
-    node->~Node();
+    concrete(node)->~Node();
 #endif
-    d->freeNode(node);
+    qFree(node);
 }
 
 template <class Key, class T>
@@ -538,18 +550,7 @@ Q_INLINE_TEMPLATE QHash<Key, T> &QHash<Key, T>::unite(const QHash<Key, T> &other
 template <class Key, class T>
 Q_OUTOFLINE_TEMPLATE void QHash<Key, T>::freeData(QHashData *x)
 {
-    Node *e_for_x = reinterpret_cast<Node *>(x);
-    Node **bucket = reinterpret_cast<Node **>(x->buckets);
-    int n = x->numBuckets;
-    while (n--) {
-        Node *cur = *bucket++;
-        while (cur != e_for_x) {
-            Node *next = cur->next;
-            deleteNode(cur);
-            cur = next;
-        }
-    }
-    x->destroyAndFree();
+    x->free_helper(deleteNode);
 }
 
 template <class Key, class T>
@@ -561,7 +562,7 @@ Q_INLINE_TEMPLATE void QHash<Key, T>::clear()
 template <class Key, class T>
 Q_OUTOFLINE_TEMPLATE void QHash<Key, T>::detach_helper()
 {
-    QHashData *x = d->detach_helper(duplicateNode,
+    QHashData *x = d->detach_helper(duplicateNode, deleteNode,
         QTypeInfo<T>::isDummy ? sizeof(DummyNode) : sizeof(Node));
     if (!d->ref.deref())
         freeData(d);
diff --git a/src/corelib/tools/qlinkedlist.h b/src/corelib/tools/qlinkedlist.h
index 6a85386..79311bc 100644
--- a/src/corelib/tools/qlinkedlist.h
+++ b/src/corelib/tools/qlinkedlist.h
@@ -265,15 +265,22 @@ void QLinkedList<T>::detach_helper()
     x.d->ref = 1;
     x.d->size = d->size;
     x.d->sharable = true;
-    Node *i = e->n, *j = x.e;
-    while (i != e) {
-        j->n = new Node(i->t);
-        j->n->p = j;
-        i = i->n;
-        j = j->n;
+    Node *original = e->n;
+    Node *copy = x.e;
+    while (original != e) {
+        QT_TRY {
+            copy->n = new Node(original->t);
+            copy->n->p = copy;
+            original = original->n;
+            copy = copy->n;
+        } QT_CATCH(...) {
+            copy->n = x.e;
+            free(x.d);
+            QT_RETHROW;
+        }
     }
-    j->n = x.e;
-    x.e->p = j;
+    copy->n = x.e;
+    x.e->p = copy;
     if (!d->ref.deref())
         free(d);
     d = x.d;
@@ -474,14 +481,21 @@ QLinkedList<T> &QLinkedList<T>::operator+=(const QLinkedList<T> &l)
     detach();
     int n = l.d->size;
     d->size += n;
-    Node *o = l.e->n;
+    Node *original = l.e->n;
     while (n--) {
-        Node *i = new Node(o->t);
-        o = o->n;
-        i->n = e;
-        i->p = e->p;
-        i->p->n = i;
-        e->p = i;
+        QT_TRY {
+            Node *copy = new Node(original->t);
+            original = original->n;
+            copy->n = e;
+            copy->p = e->p;
+            copy->p->n = copy;
+            e->p = copy;
+        } QT_CATCH(...) {
+            // restore the original list
+            while (n++<d->size)
+                removeLast();
+            QT_RETHROW;
+        }
     }
     return *this;
 }
diff --git a/src/corelib/tools/qlist.h b/src/corelib/tools/qlist.h
index 3c21ec1..89e082b 100644
--- a/src/corelib/tools/qlist.h
+++ b/src/corelib/tools/qlist.h
@@ -117,6 +117,7 @@ public:
     inline int size() const { return p.size(); }
 
     inline void detach() { if (d->ref != 1) detach_helper(); }
+    inline void detachShared() { if (d->ref != 1 && d != &QListData::shared_null) detach_helper(); }
     inline bool isDetached() const { return d->ref == 1; }
     inline void setSharable(bool sharable) { if (!sharable) detach(); d->sharable = sharable; }
 
@@ -352,12 +353,27 @@ Q_INLINE_TEMPLATE void QList<T>::node_destruct(Node *n)
 template <typename T>
 Q_INLINE_TEMPLATE void QList<T>::node_copy(Node *from, Node *to, Node *src)
 {
-    if (QTypeInfo<T>::isLarge || QTypeInfo<T>::isStatic)
-        while(from != to)
-            (from++)->v = new T(*reinterpret_cast<T*>((src++)->v));
-    else if (QTypeInfo<T>::isComplex)
-        while(from != to)
-            new (from++) T(*reinterpret_cast<T*>(src++));
+    Node *current = from;
+    if (QTypeInfo<T>::isLarge || QTypeInfo<T>::isStatic) {
+        QT_TRY {
+            while(current != to)
+                (current++)->v = new T(*reinterpret_cast<T*>((src++)->v));
+        } QT_CATCH(...) {
+            while (current != from)
+                delete reinterpret_cast<T*>(current--);
+            QT_RETHROW;
+        }
+    }
+    else if (QTypeInfo<T>::isComplex) {
+        QT_TRY {
+            while(current != to)
+                new (current++) T(*reinterpret_cast<T*>(src++));
+        } QT_CATCH(...) {
+            while (current != from)
+                (reinterpret_cast<T*>(current--))->~T();
+            QT_RETHROW;
+        }
+    }
 }
 
 template <typename T>
@@ -384,8 +400,16 @@ Q_INLINE_TEMPLATE QList<T> &QList<T>::operator=(const QList<T> &l)
 }
 template <typename T>
 inline typename QList<T>::iterator QList<T>::insert(iterator before, const T &t)
-{ Node *n = reinterpret_cast<Node *>(p.insert(before.i-reinterpret_cast<Node *>(p.begin())));
- node_construct(n,t); return n; }
+{
+    Node *n = reinterpret_cast<Node *>(p.insert(before.i - reinterpret_cast<Node *>(p.begin())));
+    QT_TRY {
+        node_construct(n, t);
+    } QT_CATCH(...) {
+        p.remove(before.i - reinterpret_cast<Node *>(p.begin()));
+        QT_RETHROW;
+    }
+    return n;
+}
 template <typename T>
 inline typename QList<T>::iterator QList<T>::erase(iterator it)
 { node_destruct(it.i);
@@ -423,10 +447,22 @@ Q_OUTOFLINE_TEMPLATE void QList<T>::append(const T &t)
 {
     detach();
     if (QTypeInfo<T>::isLarge || QTypeInfo<T>::isStatic) {
-        node_construct(reinterpret_cast<Node *>(p.append()), t);
+        Node *n = reinterpret_cast<Node *>(p.append());
+        QT_TRY {
+            node_construct(n, t);
+        } QT_CATCH(...) {
+            --d->end;
+            QT_RETHROW;
+        }
     } else {
         const T cpy(t);
-        node_construct(reinterpret_cast<Node *>(p.append()), cpy);
+        Node *n = reinterpret_cast<Node *>(p.append());
+        QT_TRY {
+            node_construct(n, cpy);
+        } QT_CATCH(...) {
+            --d->end;
+            QT_RETHROW;
+        }
     }
 }
 
@@ -435,10 +471,22 @@ inline void QList<T>::prepend(const T &t)
 {
     detach();
     if (QTypeInfo<T>::isLarge || QTypeInfo<T>::isStatic) {
-        node_construct(reinterpret_cast<Node *>(p.prepend()), t);
+        Node *n = reinterpret_cast<Node *>(p.prepend());
+        QT_TRY {
+            node_construct(n, t);
+        } QT_CATCH(...) {
+            ++d->begin;
+            QT_RETHROW;
+        }
     } else {
         const T cpy(t);
-        node_construct(reinterpret_cast<Node *>(p.prepend()), cpy);
+        Node *n = reinterpret_cast<Node *>(p.prepend());
+        QT_TRY {
+            node_construct(n, cpy);
+        } QT_CATCH(...) {
+            ++d->begin;
+            QT_RETHROW;
+        }
     }
 }
 
@@ -447,10 +495,22 @@ inline void QList<T>::insert(int i, const T &t)
 {
     detach();
     if (QTypeInfo<T>::isLarge || QTypeInfo<T>::isStatic) {
-        node_construct(reinterpret_cast<Node *>(p.insert(i)), t);
+        Node *n = reinterpret_cast<Node *>(p.insert(i));
+        QT_TRY {
+            node_construct(n, t);
+        } QT_CATCH(...) {
+            p.remove(i);
+            QT_RETHROW;
+        }
     } else {
         const T cpy(t);
-        node_construct(reinterpret_cast<Node *>(p.insert(i)), cpy);
+        Node *n = reinterpret_cast<Node *>(p.insert(i));
+        QT_TRY {
+            node_construct(n, cpy);
+        } QT_CATCH(...) {
+            p.remove(i);
+            QT_RETHROW;
+        }
     }
 }
 
@@ -522,7 +582,14 @@ Q_OUTOFLINE_TEMPLATE void QList<T>::detach_helper()
 {
     Node *n = reinterpret_cast<Node *>(p.begin());
     QListData::Data *x = p.detach2();
-    node_copy(reinterpret_cast<Node *>(p.begin()), reinterpret_cast<Node *>(p.end()), n);
+    QT_TRY {
+        node_copy(reinterpret_cast<Node *>(p.begin()), reinterpret_cast<Node *>(p.end()), n);
+    } QT_CATCH(...) {
+        qFree(d);
+        d = x;
+        QT_RETHROW;
+    }
+
     if (!x->ref.deref())
         free(x);
 }
@@ -572,7 +639,7 @@ Q_OUTOFLINE_TEMPLATE void QList<T>::clear()
 template <typename T>
 Q_OUTOFLINE_TEMPLATE int QList<T>::removeAll(const T &_t)
 {
-    detach();
+    detachShared();
     const T t = _t;
     int removedCount=0, i=0;
     Node *n;
@@ -590,7 +657,7 @@ Q_OUTOFLINE_TEMPLATE int QList<T>::removeAll(const T &_t)
 template <typename T>
 Q_OUTOFLINE_TEMPLATE bool QList<T>::removeOne(const T &_t)
 {
-    detach();
+    detachShared();
     int index = indexOf(_t);
     if (index != -1) {
         removeAt(index);
diff --git a/src/corelib/tools/qlistdata.cpp b/src/corelib/tools/qlistdata.cpp
index 34a5d80..efdde64 100644
--- a/src/corelib/tools/qlistdata.cpp
+++ b/src/corelib/tools/qlistdata.cpp
@@ -39,6 +39,7 @@
 **
 ****************************************************************************/
 
+#include <new>
 #include "qlist.h"
 #include "qtools_p.h"
 #include <string.h>
@@ -71,8 +72,7 @@ static int grow(int size)
 QListData::Data *QListData::detach()
 {
     Data *x = static_cast<Data *>(qMalloc(DataHeaderSize + d->alloc * sizeof(void *)));
-    if (!x)
-        qFatal("QList: Out of memory");
+    Q_CHECK_PTR(x);
 
     ::memcpy(x, d, DataHeaderSize + d->alloc * sizeof(void *));
     x->alloc = d->alloc;
@@ -91,10 +91,10 @@ QListData::Data *QListData::detach()
 QListData::Data *QListData::detach2()
 {
     Data *x = d;
-    d = static_cast<Data *>(qMalloc(DataHeaderSize + x->alloc * sizeof(void *)));
-    if (!d)
-        qFatal("QList: Out of memory");
+    Data* t = static_cast<Data *>(qMalloc(DataHeaderSize + x->alloc * sizeof(void *)));
+    Q_CHECK_PTR(t);
 
+    d = t;
     ::memcpy(d, x, DataHeaderSize + x->alloc * sizeof(void *));
     d->alloc = x->alloc;
     d->ref = 1;
@@ -109,8 +109,7 @@ void QListData::realloc(int alloc)
 {
     Q_ASSERT(d->ref == 1);
     Data *x = static_cast<Data *>(qRealloc(d, DataHeaderSize + alloc * sizeof(void *)));
-    if (!x)
-        qFatal("QList: Out of memory");
+    Q_CHECK_PTR(x);
 
     d = x;
     d->alloc = alloc;
@@ -514,6 +513,15 @@ void **QListData::erase(void **xi)
     \internal
 */
 
+/*! \fn void QList::detachShared()
+
+    \internal
+
+    like detach(), but does nothing if we're shared_null.
+    This prevents needless mallocs, and makes QList more exception safe
+    in case of cleanup work done in destructors on empty lists.
+*/
+
 /*! \fn bool QList::isDetached() const
 
     \internal
diff --git a/src/corelib/tools/qlocale.cpp b/src/corelib/tools/qlocale.cpp
index 4d042ae..4317933 100644
--- a/src/corelib/tools/qlocale.cpp
+++ b/src/corelib/tools/qlocale.cpp
@@ -5124,6 +5124,7 @@ static Bigint *Balloc(int k)
 
     x = 1 << k;
     rv = static_cast<Bigint *>(MALLOC(sizeof(Bigint) + (x-1)*sizeof(Long)));
+    Q_CHECK_PTR(rv);
     rv->k = k;
     rv->maxwds = x;
     rv->sign = rv->wds = 0;
@@ -6788,6 +6789,7 @@ static char *_qdtoa( NEEDS_VOLATILE double d, int mode, int ndigits, int *decpt,
             i = 1;
     }
     *resultp = static_cast<char *>(malloc(i + 1));
+    Q_CHECK_PTR(resultp);
     s = s0 = *resultp;
 
     if (ilim >= 0 && ilim <= Quick_max && try_quick) {
@@ -7209,6 +7211,7 @@ Q_CORE_EXPORT char *qdtoa( double d, int mode, int ndigits, int *decpt, int *sig
         n = i + 1;
     }
     *resultp = static_cast<char*>(malloc(n + 1));
+    Q_CHECK_PTR(resultp);
     qstrncpy(*resultp, res, n + 1);
     return *resultp;
 }
diff --git a/src/corelib/tools/qmap.cpp b/src/corelib/tools/qmap.cpp
index 07df28d..ceaf370 100644
--- a/src/corelib/tools/qmap.cpp
+++ b/src/corelib/tools/qmap.cpp
@@ -59,6 +59,7 @@ QMapData QMapData::shared_null = {
 QMapData *QMapData::createData()
 {
     QMapData *d = new QMapData;
+    Q_CHECK_PTR(d);
     Node *e = reinterpret_cast<Node *>(d);
     e->backward = e;
     e->forward[0] = e;
@@ -84,6 +85,15 @@ void QMapData::continueFreeData(int offset)
     delete this;
 }
 
+/*!
+    Creates a new node inside the data structure.
+
+    \a update is an array with pointers to the node after which the new node
+    should be inserted. Because of the strange skip list data structure there
+    could be several pointers to this node on different levels.
+    \a offset is an amount of bytes that needs to reserved just before the
+    QMapData::Node structure.
+*/
 QMapData::Node *QMapData::node_create(Node *update[], int offset)
 {
     int level = 0;
@@ -94,10 +104,6 @@ QMapData::Node *QMapData::node_create(Node *update[], int offset)
         mask <<= Sparseness;
     }
 
-    ++randomBits;
-    if (level == 3 && !insertInOrder)
-        randomBits = qrand();
-
     if (level > topLevel) {
         Node *e = reinterpret_cast<Node *>(this);
         level = ++topLevel;
@@ -105,7 +111,13 @@ QMapData::Node *QMapData::node_create(Node *update[], int offset)
         update[level] = e;
     }
 
+    ++randomBits;
+    if (level == 3 && !insertInOrder)
+        randomBits = qrand();
+
     void *concreteNode = qMalloc(offset + sizeof(Node) + level * sizeof(Node *));
+    Q_CHECK_PTR(concreteNode);
+
     Node *abstractNode = reinterpret_cast<Node *>(reinterpret_cast<char *>(concreteNode) + offset);
 
     abstractNode->backward = update[0];
@@ -116,6 +128,7 @@ QMapData::Node *QMapData::node_create(Node *update[], int offset)
         update[i]->forward[i] = abstractNode;
         update[i] = abstractNode;
     }
+    // update[level+1]=reinterpret_cast<Node *>(this);
     ++size;
     return abstractNode;
 }
@@ -146,7 +159,7 @@ uint QMapData::adjust_ptr(Node *node)
 
 void QMapData::dump()
 {
-    qDebug("Map data (ref = %d, size = %d, randomBits = %#.8x)", ref.atomic, size, randomBits);
+    qDebug("Map data (ref = %d, size = %d, randomBits = %#.8x)", int(ref), size, randomBits);
 
     QString preOutput;
     QVector<QString> output(topLevel + 1);
@@ -158,12 +171,12 @@ void QMapData::dump()
 
     Node *update[LastLevel + 1];
     for (int i = 0; i <= topLevel; ++i) {
-        str.sprintf("%d: [%.8x] -", i, adjust_ptr(forward[i]));
+        str.sprintf("%d: [%.8x] -", i, adjust_ptr(reinterpret_cast<Node *>(forward[i])));
         output[i] += str;
-        update[i] = forward[i];
+        update[i] = reinterpret_cast<Node *>(forward[i]);
     }
 
-    Node *node = forward[0];
+    Node *node = reinterpret_cast<Node *>(forward[0]);
     while (node != e) {
         int level = 0;
         while (level < topLevel && update[level + 1] == node)
@@ -178,13 +191,13 @@ void QMapData::dump()
             update[i] = node->forward[i];
         }
         for (int j = level + 1; j <= topLevel; ++j)
-            output[j] += "---------------";
+            output[j] += QString("---------------");
         node = node->forward[0];
     }
 
-    qDebug(preOutput.ascii());
+    qDebug("%s", preOutput.ascii());
     for (int i = 0; i <= topLevel; ++i)
-        qDebug(output[i].ascii());
+        qDebug("%s", output[i].ascii());
 }
 #endif
 
diff --git a/src/corelib/tools/qmap.h b/src/corelib/tools/qmap.h
index 0215a78..bd9ba74 100644
--- a/src/corelib/tools/qmap.h
+++ b/src/corelib/tools/qmap.h
@@ -416,9 +416,29 @@ Q_INLINE_TEMPLATE typename QMapData::Node *
 QMap<Key, T>::node_create(QMapData *adt, QMapData::Node *aupdate[], const Key &akey, const T &avalue)
 {
     QMapData::Node *abstractNode = adt->node_create(aupdate, payload());
-    Node *concreteNode = concrete(abstractNode);
-    new (&concreteNode->key) Key(akey);
-    new (&concreteNode->value) T(avalue);
+    QT_TRY {
+        Node *concreteNode = concrete(abstractNode);
+        new (&concreteNode->key) Key(akey);
+        QT_TRY {
+            new (&concreteNode->value) T(avalue);
+        } QT_CATCH(...) {
+            concreteNode->key.~Key();
+            QT_RETHROW;
+        }
+    } QT_CATCH(...) {
+        adt->node_delete(aupdate, payload(), abstractNode);
+        QT_RETHROW;
+    }
+
+    // clean up the update array for further insertions
+    /*
+    for (int i = 0; i <= d->topLevel; ++i) {
+        if ( aupdate[i]==reinterpret_cast<QMapData::Node *>(adt) || aupdate[i]->forward[i] != abstractNode)
+            break;
+        aupdate[i] = abstractNode;
+    }
+*/
+
     return abstractNode;
 }
 
@@ -704,8 +724,13 @@ Q_OUTOFLINE_TEMPLATE void QMap<Key, T>::detach_helper()
         QMapData::Node *cur = e->forward[0];
         update[0] = x.e;
         while (cur != e) {
-            Node *concreteNode = concrete(cur);
-            node_create(x.d, update, concreteNode->key, concreteNode->value);
+            QT_TRY {
+                Node *concreteNode = concrete(cur);
+                node_create(x.d, update, concreteNode->key, concreteNode->value);
+            } QT_CATCH(...) {
+                freeData(x.d);
+                QT_RETHROW;
+            }
             cur = cur->forward[0];
         }
         x.d->insertInOrder = false;
diff --git a/src/corelib/tools/qpodlist_p.h b/src/corelib/tools/qpodlist_p.h
index 9708f8d..9e6d19b 100644
--- a/src/corelib/tools/qpodlist_p.h
+++ b/src/corelib/tools/qpodlist_p.h
@@ -53,9 +53,7 @@
 // We mean it.
 //
 
-#include <QtCore/qcontainerfwd.h>
-#include <QtCore/qglobal.h>
-#include <new>
+#include <QtCore/qvarlengtharray.h>
 
 QT_BEGIN_HEADER
 
@@ -63,87 +61,29 @@ QT_BEGIN_NAMESPACE
 
 QT_MODULE(Core)
 
-template<class T, int Prealloc>
-class QPodList
+template <typename T, int Prealloc>
+class QPodList : public QVarLengthArray<T, Prealloc>
 {
+    using QVarLengthArray<T, Prealloc>::s;
+    using QVarLengthArray<T, Prealloc>::a;
+    using QVarLengthArray<T, Prealloc>::ptr;
+    using QVarLengthArray<T, Prealloc>::realloc;
 public:
-    inline explicit QPodList(int size = 0);
+    inline explicit QPodList(int size = 0)
+        : QVarLengthArray<T, Prealloc>(size)
+    {}
 
-    inline QPodList(const QPodList<T, Prealloc> &other)
-        : a(Prealloc), s(0), ptr(reinterpret_cast<T *>(array))
+    inline void insert(int idx, const T &t)
     {
-        append(other.constData(), other.size());
-    }
-
-    inline ~QPodList() {
-        if (ptr != reinterpret_cast<T *>(array))
-            qFree(ptr);
-    }
-    inline QPodList<T, Prealloc> &operator=(const QPodList<T, Prealloc> &other)
-    {
-        if (this != &other) {
-            clear();
-            append(other.constData(), other.size());
-        }
-        return *this;
-    }
-
-    inline int size() const { return s; }
-    inline int count() const { return s; }
-    inline bool isEmpty() const { return (s == 0); }
-    inline void resize(int size);
-    inline void clear() { resize(0); }
-
-    inline int capacity() const { return a; }
-    inline void reserve(int size);
-
-    inline T &operator[](int idx) {
-        Q_ASSERT(idx >= 0 && idx < s);
-        return ptr[idx];
-    }
-    inline const T &operator[](int idx) const {
-        Q_ASSERT(idx >= 0 && idx < s);
-        return ptr[idx];
-    }
-
-    inline const T &at(int idx) const {
-        Q_ASSERT(idx >= 0 && idx < s);
-        return ptr[idx];
-    }
-
-    inline const T &first() const {
-        return at(0);
-    }
-
-    inline T& append() {
-        const int idx = s++;
-        if (s == a)
-            realloc(s, s<<1);
-        return ptr[idx];
-    }
-    inline void append(const T &t) {
-        append() = t;
-    }
-
-    inline T& insert(int idx) {
-        Q_ASSERT(idx >= 0 && idx <= s);
         const int sz = s++;
         if (s == a)
-            realloc(s, s<<1);
+            realloc(s, s << 1);
         ::memmove(ptr + idx + 1, ptr + idx, (sz - idx) * sizeof(T));
-        return ptr[idx];
-    }
-    inline void insert(int idx, const T &t) {
-        insert(idx) = t;
+        ptr[idx] = t;
     }
 
-    inline void removeAt(int idx) {
-        Q_ASSERT(idx >= 0 && idx < s);
-        ::memmove(ptr + idx, ptr + idx + 1, (s - idx - 1) * sizeof(T));
-        --s;
-    }
-
-    inline void removeAll(const T &t) {
+    inline void removeAll(const T &t)
+    {
         int i = 0;
         for (int j = 0; j < s; ++j) {
             if (ptr[j] != t)
@@ -152,110 +92,22 @@ public:
         s = i;
     }
 
-    inline int indexOf(const T &t, int from = 0) const {
-        if (from < 0)
-            from = qMax(from + s, 0);
-        if (from < s) {
-            const T *n = ptr + from - 1;
-            const T *e = ptr + s;
-            while (++n != e)
-                if (*n == t)
-                    return n - ptr;
-        }
-        return -1;
-    }
-
-    inline bool contains(const T &t) const {
-        return indexOf(t) >= 0;
+    inline void removeAt(int idx)
+    {
+        Q_ASSERT(idx >= 0 && idx < s);
+        ::memmove(ptr + idx, ptr + idx + 1, (s - idx - 1) * sizeof(T));
+        --s;
     }
 
-    inline T takeFirst() {
+    inline T takeFirst()
+    {
         Q_ASSERT(s > 0);
         T tmp = ptr[0];
         removeAt(0);
         return tmp;
     }
-
-    inline T *data() { return ptr; }
-    inline const T *data() const { return ptr; }
-    inline const T * constData() const { return ptr; }
-
-private:
-    void append(const T *buf, int size);
-    void realloc(int size, int alloc);
-
-    int a;
-    int s;
-    T *ptr;
-    union {
-        // ### Qt 5: Use 'Prealloc * sizeof(T)' as array size
-        char array[sizeof(qint64) * (((Prealloc * sizeof(T)) / sizeof(qint64)) + 1)];
-        qint64 q_for_alignment_1;
-        double q_for_alignment_2;
-    };
 };
 
-template <class T, int Prealloc>
-Q_INLINE_TEMPLATE QPodList<T, Prealloc>::QPodList(int asize)
-    : s(asize) {
-    if (s > Prealloc) {
-        ptr = reinterpret_cast<T *>(qMalloc(s * sizeof(T)));
-        a = s;
-    } else {
-        ptr = reinterpret_cast<T *>(array);
-        a = Prealloc;
-    }
-}
-
-template <class T, int Prealloc>
-Q_INLINE_TEMPLATE void QPodList<T, Prealloc>::resize(int asize)
-{ realloc(asize, qMax(asize, a)); }
-
-template <class T, int Prealloc>
-Q_INLINE_TEMPLATE void QPodList<T, Prealloc>::reserve(int asize)
-{ if (asize > a) realloc(s, asize); }
-
-template <class T, int Prealloc>
-Q_OUTOFLINE_TEMPLATE void QPodList<T, Prealloc>::append(const T *abuf, int asize)
-{
-    Q_ASSERT(abuf);
-    if (asize <= 0)
-        return;
-
-    const int idx = s;
-    const int news = s + asize;
-    if (news >= a)
-        realloc(news, news<<1);
-    else
-        s = news;
-
-    qMemCopy(&ptr[idx], abuf, asize * sizeof(T));
-}
-
-template <class T, int Prealloc>
-Q_OUTOFLINE_TEMPLATE void QPodList<T, Prealloc>::realloc(int asize, int aalloc)
-{
-    Q_ASSERT(aalloc >= asize);
-    T *oldPtr = ptr;
-    int osize = s;
-    s = asize;
-
-    if (aalloc != a) {
-        ptr = reinterpret_cast<T *>(qMalloc(aalloc * sizeof(T)));
-        if (ptr) {
-            a = aalloc;
-            qMemCopy(ptr, oldPtr, osize * sizeof(T));
-        } else {
-            ptr = oldPtr;
-            s = 0;
-            asize = 0;
-        }
-    }
-
-    if (oldPtr != reinterpret_cast<T *>(array) && oldPtr != ptr)
-        qFree(oldPtr);
-}
-
 QT_END_NAMESPACE
 
 QT_END_HEADER
diff --git a/src/corelib/tools/qregexp.cpp b/src/corelib/tools/qregexp.cpp
index e1c3921..f357956 100644
--- a/src/corelib/tools/qregexp.cpp
+++ b/src/corelib/tools/qregexp.cpp
@@ -1297,14 +1297,20 @@ void QRegExpMatchState::prepareForMatch(QRegExpEngine *eng)
     int ns = eng->s.size(); // number of states
     int ncap = eng->ncap;
 #ifndef QT_NO_REGEXP_OPTIM
-    slideTabSize = qMax(eng->minl + 1, 16);
+    int newSlideTabSize = qMax(eng->minl + 1, 16);
 #else
-    slideTabSize = 0;
+    int newSlideTabSize = 0;
 #endif
     int numCaptures = eng->numCaptures();
-    capturedSize = 2 + 2 * numCaptures;
-    bigArray = (int *)realloc(bigArray, ((3 + 4 * ncap) * ns + 4 * ncap + slideTabSize + capturedSize)*sizeof(int));
+    int newCapturedSize = 2 + 2 * numCaptures;
+    bigArray = (int *)realloc(bigArray, ((3 + 4 * ncap) * ns + 4 * ncap + newSlideTabSize + newCapturedSize)*sizeof(int));
+    Q_CHECK_PTR(bigArray);
 
+    // set all internal variables only _after_ bigArray is realloc'ed
+    // to prevent a broken regexp in oom case
+
+    slideTabSize = newSlideTabSize;
+    capturedSize = newCapturedSize;
     inNextStack = bigArray;
     memset(inNextStack, -1, ns * sizeof(int));
     curStack = inNextStack + ns;
@@ -3281,10 +3287,15 @@ static void derefEngine(QRegExpEngine *eng, const QRegExpEngineKey &key)
 #if !defined(QT_NO_REGEXP_OPTIM)
         if (globalEngineCache()) {
             QMutexLocker locker(mutex());
-            globalEngineCache()->insert(key, eng, 4 + key.pattern.length() / 4);
-        }
-        else
+            QT_TRY {
+                globalEngineCache()->insert(key, eng, 4 + key.pattern.length() / 4);
+            } QT_CATCH(const std::bad_alloc &) {
+                // in case of an exception (e.g. oom), just delete the engine
+                delete eng;
+            }
+        } else {
             delete eng;
+        }
 #else
         Q_UNUSED(key);
         delete eng;
diff --git a/src/corelib/tools/qringbuffer_p.h b/src/corelib/tools/qringbuffer_p.h
index 3a0901d..ac33353 100644
--- a/src/corelib/tools/qringbuffer_p.h
+++ b/src/corelib/tools/qringbuffer_p.h
@@ -199,9 +199,8 @@ public:
 
     inline void clear() {
         if(!buffers.isEmpty()) {
-            QByteArray tmp = buffers[0];
-            buffers.clear();
-            buffers << tmp;
+            // remove all but the first
+            buffers.erase(buffers.begin() + 1, buffers.end());
             if (buffers.at(0).size() != basicBlockSize)
                 buffers[0].resize(basicBlockSize);
         }
diff --git a/src/corelib/tools/qscopedpointer.cpp b/src/corelib/tools/qscopedpointer.cpp
new file mode 100644
index 0000000..8150a18
--- /dev/null
+++ b/src/corelib/tools/qscopedpointer.cpp
@@ -0,0 +1,132 @@
+/****************************************************************************
+**
+** Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies).
+** Contact: Qt Software Information (qt-info@nokia.com)
+**
+** This file is part of the $MODULE$ of the Qt Toolkit.
+**
+** $TROLLTECH_DUAL_LICENSE$
+**
+****************************************************************************/
+
+/*!
+    \class QScopedPointer
+    \brief The QScopedPointer class stores a pointer to a dynamically allocated object, and deletes it upon destruction.
+    \since 4.6
+    \reentrant
+    \ingroup misc
+
+    Managing heap allocated objects manually is hard and error prone, with the
+    common result that code leaks memory and is hard to maintain.
+    QScopedPointer is a small utility class that heavily simplifies this by
+    assigning stack-based memory ownership to heap allocations, more generally
+    called resource acquisition is initialization(RAII).
+
+    QScopedPointer guarantees that the object pointed to will get deleted when
+    the current scope dissapears, and it also has no way of releasing
+    ownership, hence clearly communicating the lifetime and ownership of the
+    object. These guarantees are convenient when reading the code.
+
+    Consider this function which does heap allocations, and have various exit points:
+
+    \snippet doc/src/snippets/code/src_corelib_tools_qscopedpointer.cpp 0
+
+    It's encumbered by the manual delete calls. With QScopedPointer, the code
+    can be simplified to:
+
+    \snippet doc/src/snippets/code/src_corelib_tools_qscopedpointer.cpp 1
+
+    The code the compiler generates for QScopedPointer is the same as when
+    writing it manually. Code that makes use of \a delete are candidates for
+    QScopedPointer usage(and if not, possibly another type of smart pointer
+    such as QSharedPointer). QScopedPointer intentionally has no copy
+    constructor or assignment operator, such that ownership and lifetime is
+    clearly communicated.
+
+    The const qualification on a regular C++ pointer can also be expressed with
+    a QScopedPointer:
+
+    \snippet doc/src/snippets/code/src_corelib_tools_qscopedpointer.cpp 2
+
+    \note QScopedPointer does not work with arrays.
+
+    \sa QSharedPointer
+*/
+
+/*!
+    \fn QScopedPointer::QScopedPointer(T *p = 0)
+
+    Constructs this QScopedPointer instance and sets its pointer to \a p.
+*/
+
+/*!
+    \fn QScopedPointer::~QScopedPointer()
+
+    Destroys this QScopedPointer object. Delete the object its pointer points
+    to.
+*/
+
+/*!
+    \fn T *QScopedPointer::data() const
+
+    Returns the value of the pointer referenced by this object. QScopedPointer
+    still owns the object pointed to.
+*/
+
+/*!
+    \fn T &QScopedPointer::operator*() const
+
+    Provides access to the scoped pointer's object.
+
+    If the contained pointer is \c null, behavior is undefined.
+    \sa isNull()
+*/
+
+/*!
+    \fn T *QScopedPointer::operator->() const
+
+    Provides access to the scoped pointer's object.
+
+    If the contained pointer is \c null, behavior is undefined.
+
+    \sa isNull()
+*/
+
+/*!
+    \fn QScopedPointer::operator bool() const
+
+    Returns \c true if this object is not \c null. This function is suitable
+    for use in \tt if-constructs, like:
+
+    \snippet doc/src/snippets/code/src_corelib_tools_qscopedpointer.cpp 3
+
+    \sa isNull()
+*/
+
+/*!
+    \fn bool QScopedPointer::isNull() const
+
+    Returns \c true if this object is holding a pointer that is \c null.
+*/
+
+/*!
+    \fn void QScopedPointer::reset(T *other = 0)
+
+    Deletes the existing object its pointing to if any, and sets its pointer to
+    \a other. QScopedPointer now owns \a other and will delete it in its
+    destructor.
+
+    If \a other is equal to the value returned by data(), behavior is
+    undefined.
+*/
+
+/*!
+    \fn T *QScopedPointer::take()
+
+    Returns the value of the pointer referenced by this object. The pointer of this
+    QScopedPointer object will be reset to \c null.
+*/
+
+QT_END_NAMESPACE
+
+#endif
diff --git a/src/corelib/tools/qscopedpointer.h b/src/corelib/tools/qscopedpointer.h
new file mode 100644
index 0000000..fc8f9e2
--- /dev/null
+++ b/src/corelib/tools/qscopedpointer.h
@@ -0,0 +1,199 @@
+/****************************************************************************
+**
+** Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies).
+** Contact: Qt Software Information (qt-info@nokia.com)
+**
+** This file is part of the QtCore module of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** No Commercial Usage
+** This file contains pre-release code and may not be distributed.
+** You may use this file in accordance with the terms and conditions
+** contained in the either Technology Preview License Agreement or the
+** Beta Release License Agreement.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file.  Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Nokia gives you certain
+** additional rights. These rights are described in the Nokia Qt LGPL
+** Exception version 1.0, included in the file LGPL_EXCEPTION.txt in this
+** package.
+**
+** GNU General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU
+** General Public License version 3.0 as published by the Free Software
+** Foundation and appearing in the file LICENSE.GPL included in the
+** packaging of this file.  Please review the following information to
+** ensure the GNU General Public License version 3.0 requirements will be
+** met: http://www.gnu.org/copyleft/gpl.html.
+**
+** If you are unsure which license is appropriate for your use, please
+** contact the sales department at qt-sales@nokia.com.
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+#ifndef QSCOPEDPOINTER_H
+#define QSCOPEDPOINTER_H
+
+#include <QtCore/qglobal.h>
+
+QT_BEGIN_HEADER
+QT_BEGIN_NAMESPACE
+QT_MODULE(Core)
+
+template <typename T>
+class QScopedPointer
+{
+public:
+    explicit inline QScopedPointer(T *p = 0) : d(p)
+    {
+    }
+
+    inline ~QScopedPointer()
+    {
+        delete d;
+    }
+
+    inline T &operator*() const
+    {
+        return *d;
+    }
+
+    inline T *operator->() const
+    {
+        return d;
+    }
+
+    inline bool operator==(const QScopedPointer<T> &other) const
+    {
+        return d == other.d;
+    }
+
+    inline bool operator!=(const QScopedPointer<T> &other) const
+    {
+        return d != other.d;
+    }
+
+    inline operator bool() const
+    {
+        return d;
+    }
+
+    inline T *data() const
+    {
+        return d;
+    }
+
+    inline bool isNull() const
+    {
+        return !d;
+    }
+
+    inline void reset(T *other = 0)
+    {
+        T *oldD = d;
+        d = other;
+        delete oldD;
+    }
+
+    inline T *take()
+    {
+        T *oldD = d;
+        d = 0;
+        return oldD;
+    }
+
+protected:
+    T *d;
+
+private:
+    Q_DISABLE_COPY(QScopedPointer)
+};
+
+/* internal class - allows special handling for resetting and cleaning the pointer */
+template <typename T, typename CustomHandler>
+class QScopedCustomPointer : public QScopedPointer<T>
+{
+public:
+    inline QScopedCustomPointer(T *p = 0)
+        : QScopedPointer<T>(p)
+    {
+    }
+
+    inline ~QScopedCustomPointer()
+    {
+        T *oldD = this->d;
+        this->d = 0;
+        CustomHandler::cleanup(oldD);
+    }
+
+    inline void reset(T *other = 0)
+    {
+        CustomHandler::reset(this->d, other);
+    }
+
+    inline T *&data_ptr()
+    {
+        return this->d;
+    }
+};
+
+/* Internal helper class - a handler for QShared* classes, to be used in QScopedCustomPointer */
+template <typename T>
+class QScopedSharedPointerHandler
+{
+public:
+    static inline void cleanup(T *d)
+    {
+        if (d && !d->ref.deref())
+            delete d;
+    }
+
+    static inline void reset(T *&d, T *other)
+    {
+        T *oldD = d;
+        d = other;
+        cleanup(oldD);
+    }
+};
+
+/* Internal. This should really have been a typedef, but you can't have a templated typedef :)
+   This class is basically a scoped pointer pointing to a ref-counted object
+ */
+template <typename T>
+class QScopedSharedPointer : public QScopedCustomPointer<T, QScopedSharedPointerHandler<T> >
+{
+public:
+    inline QScopedSharedPointer(T *p = 0)
+        : QScopedCustomPointer<T, QScopedSharedPointerHandler<T> >(p)
+    {
+    }
+
+    inline void detach()
+    {
+        qAtomicDetach(this->d);
+    }
+
+    inline void assign(T *other)
+    {
+        if (this->d == other)
+            return;
+        if (other)
+            other->ref.ref();
+        T *oldD = this->d;
+        this->d = other;
+        QScopedSharedPointerHandler<T>::cleanup(oldD);
+    }
+};
+
+QT_END_NAMESPACE
+QT_END_HEADER
+
+#endif // QSCOPEDPOINTER_H
diff --git a/src/corelib/tools/qshareddata.cpp b/src/corelib/tools/qshareddata.cpp
index 2b879ea..03bc964 100644
--- a/src/corelib/tools/qshareddata.cpp
+++ b/src/corelib/tools/qshareddata.cpp
@@ -231,7 +231,7 @@ QT_BEGIN_NAMESPACE
   In the member function documentation, \e{d pointer} always refers
   to the internal pointer to the shared data object.
 
-  \sa QSharedData, QExplicitlySharedDataPointer
+  \sa QSharedData, QExplicitlySharedDataPointer, QScopedPointer, QSharedPointer
 */
 
 /*! \fn T& QSharedDataPointer::operator*()
diff --git a/src/corelib/tools/qsharedpointer.cpp b/src/corelib/tools/qsharedpointer.cpp
index c3a989e..dee06f0 100644
--- a/src/corelib/tools/qsharedpointer.cpp
+++ b/src/corelib/tools/qsharedpointer.cpp
@@ -102,13 +102,18 @@
     except that it only detaches if
     QExplicitlySharedDataPointer::detach() is explicitly called.
 
+    QScopedPointer simply holds a pointer to a heap allocated object and
+    deletes it in its destructor. This class is useful when an object needs to
+    be heap allocated and deleted, but no more. QScopedPointer is lightweight,
+    it makes no use of additional structure or reference counting.
+
     Finally, QPointer holds a pointer to a QObject-derived object, but
     it does so weakly. QPointer is similar, in that behaviour, to
     QWeakPointer: it does not allow you to prevent the object from
     being destroyed. All you can do is query whether it has been
     destroyed or not.
 
-    \sa QSharedDataPointer, QWeakPointer
+    \sa QSharedDataPointer, QWeakPointer, QScopedPointer
 */
 
 /*!
@@ -130,7 +135,7 @@
     must first create a QSharedPointer object and verify if the pointer
     is null or not.
 
-    \sa QSharedPointer
+    \sa QSharedPointer, QScopedPointer
 */
 
 /*!
diff --git a/src/corelib/tools/qstring.cpp b/src/corelib/tools/qstring.cpp
index c3649e3..e61a568 100644
--- a/src/corelib/tools/qstring.cpp
+++ b/src/corelib/tools/qstring.cpp
@@ -846,6 +846,7 @@ QString::QString(const QChar *unicode, int size)
         d->ref.ref();
     } else {
         d = (Data*) qMalloc(sizeof(Data)+size*sizeof(QChar));
+        Q_CHECK_PTR(d);
         d->ref = 1;
         d->alloc = d->size = size;
         d->clean = d->asciiCache = d->simpletext = d->righttoleft = d->capacity = 0;
@@ -869,6 +870,7 @@ QString::QString(int size, QChar ch)
         d->ref.ref();
     } else {
         d = (Data*) qMalloc(sizeof(Data)+size*sizeof(QChar));
+        Q_CHECK_PTR(d);
         d->ref = 1;
         d->alloc = d->size = size;
         d->clean = d->asciiCache = d->simpletext = d->righttoleft = d->capacity = 0;
@@ -894,7 +896,9 @@ QString::QString(int size, QChar ch)
 */
 QString::QString(QChar ch)
 {
-    d = (Data *)qMalloc(sizeof(Data) + sizeof(QChar));
+    void *buf = qMalloc(sizeof(Data) + sizeof(QChar));
+    Q_CHECK_PTR(buf);
+    d = reinterpret_cast<Data *>(buf);
     d->ref = 1;
     d->alloc = d->size = 1;
     d->clean = d->asciiCache = d->simpletext = d->righttoleft = d->capacity = 0;
@@ -1064,8 +1068,7 @@ void QString::realloc(int alloc)
 {
     if (d->ref != 1 || d->data != d->array) {
         Data *x = static_cast<Data *>(qMalloc(sizeof(Data) + alloc * sizeof(QChar)));
-        if (!x)
-            return;
+        Q_CHECK_PTR(x);
         x->size = qMin(alloc, d->size);
         ::memcpy(x->array, d->data, x->size * sizeof(QChar));
         x->array[x->size] = 0;
@@ -1088,8 +1091,7 @@ void QString::realloc(int alloc)
         }
 #endif
         Data *x = static_cast<Data *>(qRealloc(d, sizeof(Data) + alloc * sizeof(QChar)));
-        if (!x)
-            return;
+        Q_CHECK_PTR(x);
         x->alloc = alloc;
         x->data = x->array;
         d = x;
@@ -1246,6 +1248,7 @@ QString& QString::insert(int i, const QChar *unicode, int size)
     if (s >= d->data && s < d->data + d->alloc) {
         // Part of me - take a copy
         ushort *tmp = static_cast<ushort *>(qMalloc(size * sizeof(QChar)));
+        Q_CHECK_PTR(tmp);
         memcpy(tmp, s, size * sizeof(QChar));
         insert(i, reinterpret_cast<const QChar *>(tmp), size);
         qFree(tmp);
@@ -1600,51 +1603,69 @@ QString &QString::replace(const QString &before, const QString &after, Qt::CaseS
  */
 void QString::replace_helper(uint *indices, int nIndices, int blen, const QChar *after, int alen)
 {
-    if (blen == alen) {
-        detach();
-        for (int i = 0; i < nIndices; ++i)
-            memcpy(d->data + indices[i], after, alen * sizeof(QChar));
-    } else if (alen < blen) {
+    // copy *after in case it lies inside our own d->data area
+    // (which we could possibly invalidate via a realloc or corrupt via memcpy operations.)
+    QChar *afterBuffer = const_cast<QChar *>(after);
+    if (after >= reinterpret_cast<QChar *>(d->data) && after < reinterpret_cast<QChar *>(d->data) + d->size) {
+        afterBuffer = static_cast<QChar *>(qMalloc(alen*sizeof(QChar)));
+        Q_CHECK_PTR(afterBuffer);
+        ::memcpy(afterBuffer, after, alen*sizeof(QChar));
+    }
+
+    QT_TRY {
         detach();
-        uint to = indices[0];
-        if (alen)
-            memcpy(d->data+to, after, alen*sizeof(QChar));
-        to += alen;
-        uint movestart = indices[0] + blen;
-        for (int i = 1; i < nIndices; ++i) {
-            int msize = indices[i] - movestart;
-            if (msize > 0) {
-                memmove(d->data + to, d->data + movestart, msize * sizeof(QChar));
-                to += msize;
+        if (blen == alen) {
+            // replace in place
+            for (int i = 0; i < nIndices; ++i)
+                memcpy(d->data + indices[i], afterBuffer, alen * sizeof(QChar));
+        } else if (alen < blen) {
+            // replace from front
+            uint to = indices[0];
+            if (alen)
+                memcpy(d->data+to, after, alen*sizeof(QChar));
+            to += alen;
+            uint movestart = indices[0] + blen;
+            for (int i = 1; i < nIndices; ++i) {
+                int msize = indices[i] - movestart;
+                if (msize > 0) {
+                    memmove(d->data + to, d->data + movestart, msize * sizeof(QChar));
+                    to += msize;
+                }
+                if (alen) {
+                    memcpy(d->data + to, afterBuffer, alen*sizeof(QChar));
+                    to += alen;
+                }
+                movestart = indices[i] + blen;
             }
-            if (alen) {
-                memcpy(d->data + to, after, alen*sizeof(QChar));
-                to += alen;
+            int msize = d->size - movestart;
+            if (msize > 0)
+                memmove(d->data + to, d->data + movestart, msize * sizeof(QChar));
+            resize(d->size - nIndices*(blen-alen));
+        } else {
+            // replace from back
+            int adjust = nIndices*(alen-blen);
+            int newLen = d->size + adjust;
+            int moveend = d->size;
+            resize(newLen);
+
+            while (nIndices) {
+                --nIndices;
+                int movestart = indices[nIndices] + blen;
+                int insertstart = indices[nIndices] + nIndices*(alen-blen);
+                int moveto = insertstart + alen;
+                memmove(d->data + moveto, d->data + movestart,
+                        (moveend - movestart)*sizeof(QChar));
+                memcpy(d->data + insertstart, afterBuffer, alen*sizeof(QChar));
+                moveend = movestart-blen;
             }
-            movestart = indices[i] + blen;
-        }
-        int msize = d->size - movestart;
-        if (msize > 0)
-            memmove(d->data + to, d->data + movestart, msize * sizeof(QChar));
-        resize(d->size - nIndices*(blen-alen));
-    } else {
-        // we have a table of replacement positions, use them for fast replacing
-        int adjust = nIndices*(alen-blen);
-        int newLen = d->size + adjust;
-        int moveend = d->size;
-        resize(newLen);
-
-        while (nIndices) {
-            --nIndices;
-            int movestart = indices[nIndices] + blen;
-            int insertstart = indices[nIndices] + nIndices*(alen-blen);
-            int moveto = insertstart + alen;
-            memmove(d->data + moveto, d->data + movestart,
-                    (moveend - movestart)*sizeof(QChar));
-            memcpy(d->data + insertstart, after, alen*sizeof(QChar));
-            moveend = movestart-blen;
         }
+    } QT_CATCH(const std::bad_alloc &) {
+        if (afterBuffer != after)
+            qFree(afterBuffer);
+        QT_RETHROW;
     }
+    if (afterBuffer != after)
+        qFree(afterBuffer);
 }
 
 /*!
@@ -1672,21 +1693,7 @@ QString &QString::replace(const QChar *before, int blen,
     if (alen == 0 && blen == 0)
         return *this;
 
-    // protect against before or after being part of this
-    const QChar *a = after;
-    const QChar *b = before;
-    if (after >= (const QChar *)d->data && after < (const QChar *)d->data + d->size) {
-        QChar *copy = (QChar *)malloc(alen*sizeof(QChar));
-        memcpy(copy, after, alen*sizeof(QChar));
-        a = copy;
-    }
-    if (before >= (const QChar *)d->data && before < (const QChar *)d->data + d->size) {
-        QChar *copy = (QChar *)malloc(blen*sizeof(QChar));
-        memcpy(copy, before, blen*sizeof(QChar));
-        b = copy;
-    }
-
-    QStringMatcher matcher(b, blen, cs);
+    QStringMatcher matcher(before, blen, cs);
 
     int index = 0;
     while (1) {
@@ -1705,7 +1712,7 @@ QString &QString::replace(const QChar *before, int blen,
         if (!pos)
             break;
 
-        replace_helper(indices, pos, blen, a, alen);
+        replace_helper(indices, pos, blen, after, alen);
 
         if (index == -1)
             break;
@@ -1713,11 +1720,6 @@ QString &QString::replace(const QChar *before, int blen,
         index += pos*(alen-blen);
     }
 
-    if (a != after)
-        ::free((QChar *)a);
-    if (b != before)
-        ::free((QChar *)b);
-
     return *this;
 }
 
@@ -3450,6 +3452,7 @@ QString::Data *QString::fromLatin1_helper(const char *str, int size)
         if (size < 0)
             size = qstrlen(str);
         d = static_cast<Data *>(qMalloc(sizeof(Data) + size * sizeof(QChar)));
+        Q_CHECK_PTR(d);
         d->ref = 1;
         d->alloc = d->size = size;
         d->clean = d->asciiCache = d->simpletext = d->righttoleft = d->capacity = 0;
@@ -3457,7 +3460,7 @@ QString::Data *QString::fromLatin1_helper(const char *str, int size)
         ushort *i = d->data;
         d->array[size] = '\0';
         while (size--)
-           *i++ = (uchar)*str++;
+            *i++ = (uchar)*str++;
     }
     return d;
 }
@@ -6867,6 +6870,7 @@ void QString::updateProperties() const
 QString QString::fromRawData(const QChar *unicode, int size)
 {
     Data *x = static_cast<Data *>(qMalloc(sizeof(Data)));
+    Q_CHECK_PTR(x);
     if (unicode) {
         x->data = (ushort *)unicode;
     } else {
diff --git a/src/corelib/tools/qtextboundaryfinder.cpp b/src/corelib/tools/qtextboundaryfinder.cpp
index 8a8e95b..5ca6a11 100644
--- a/src/corelib/tools/qtextboundaryfinder.cpp
+++ b/src/corelib/tools/qtextboundaryfinder.cpp
@@ -176,6 +176,7 @@ QTextBoundaryFinder::QTextBoundaryFinder(const QTextBoundaryFinder &other)
     , freePrivate(true)
 {
     d = (QTextBoundaryFinderPrivate *) malloc(length*sizeof(HB_CharAttributes));
+    Q_CHECK_PTR(d);
     memcpy(d, other.d, length*sizeof(HB_CharAttributes));
 }
 
@@ -193,8 +194,11 @@ QTextBoundaryFinder &QTextBoundaryFinder::operator=(const QTextBoundaryFinder &o
     length = other.length;
     pos = other.pos;
     freePrivate = true;
-    
-    d = (QTextBoundaryFinderPrivate *) realloc(d, length*sizeof(HB_CharAttributes));
+
+    QTextBoundaryFinderPrivate *newD = (QTextBoundaryFinderPrivate *)
+        realloc(d, length*sizeof(HB_CharAttributes));
+    Q_CHECK_PTR(newD);
+    d = newD;
     memcpy(d, other.d, length*sizeof(HB_CharAttributes));
 
     return *this;
@@ -221,6 +225,7 @@ QTextBoundaryFinder::QTextBoundaryFinder(BoundaryType type, const QString &strin
     , freePrivate(true)
 {
     d = (QTextBoundaryFinderPrivate *) malloc(length*sizeof(HB_CharAttributes));
+    Q_CHECK_PTR(d);
     init(t, chars, length, d->attributes);
 }
 
@@ -248,6 +253,7 @@ QTextBoundaryFinder::QTextBoundaryFinder(BoundaryType type, const QChar *chars,
         freePrivate = false;
     } else {
         d = (QTextBoundaryFinderPrivate *) malloc(length*sizeof(HB_CharAttributes));
+        Q_CHECK_PTR(d);
         freePrivate = true;
     }
     init(t, chars, length, d->attributes);
diff --git a/src/corelib/tools/qvarlengtharray.h b/src/corelib/tools/qvarlengtharray.h
index e2f60ed..b41240e 100644
--- a/src/corelib/tools/qvarlengtharray.h
+++ b/src/corelib/tools/qvarlengtharray.h
@@ -52,6 +52,9 @@ QT_BEGIN_NAMESPACE
 
 QT_MODULE(Core)
 
+template<class T, int Prealloc>
+class QPodList;
+
 // Prealloc = 256 by default, specified in qcontainerfwd.h
 template<class T, int Prealloc>
 class QVarLengthArray
@@ -122,6 +125,7 @@ public:
     inline const T * constData() const { return ptr; }
 
 private:
+    friend class QPodList<T, Prealloc>;
     void realloc(int size, int alloc);
 
     int a;
@@ -140,6 +144,7 @@ Q_INLINE_TEMPLATE QVarLengthArray<T, Prealloc>::QVarLengthArray(int asize)
     : s(asize) {
     if (s > Prealloc) {
         ptr = reinterpret_cast<T *>(qMalloc(s * sizeof(T)));
+        Q_CHECK_PTR(ptr);
         a = s;
     } else {
         ptr = reinterpret_cast<T *>(array);
@@ -161,25 +166,24 @@ Q_INLINE_TEMPLATE void QVarLengthArray<T, Prealloc>::reserve(int asize)
 { if (asize > a) realloc(s, asize); }
 
 template <class T, int Prealloc>
-Q_OUTOFLINE_TEMPLATE void QVarLengthArray<T, Prealloc>::append(const T *abuf, int asize)
+Q_OUTOFLINE_TEMPLATE void QVarLengthArray<T, Prealloc>::append(const T *abuf, int increment)
 {
     Q_ASSERT(abuf);
-    if (asize <= 0)
+    if (increment <= 0)
         return;
 
-    const int idx = s;
-    const int news = s + asize;
-    if (news >= a)
-        realloc(s, qMax(s<<1, news));
-    s = news;
+    const int asize = s + increment;
+
+    if (asize >= a)
+        realloc(s, qMax(s*2, asize));
 
     if (QTypeInfo<T>::isComplex) {
-        T *i = ptr + idx;
-        T *j = i + asize;
-        while (i < j)
-            new (i++) T(*abuf++);
+        // call constructor for new objects (which can throw)
+        while (s < asize)
+            new (ptr+(s++)) T(*abuf++);
     } else {
-        qMemCopy(&ptr[idx], abuf, asize * sizeof(T));
+        qMemCopy(&ptr[s], abuf, increment * sizeof(T));
+        s = asize;
     }
 }
 
@@ -189,46 +193,58 @@ Q_OUTOFLINE_TEMPLATE void QVarLengthArray<T, Prealloc>::realloc(int asize, int a
     Q_ASSERT(aalloc >= asize);
     T *oldPtr = ptr;
     int osize = s;
-    s = asize;
+    // s = asize;
 
     if (aalloc != a) {
         ptr = reinterpret_cast<T *>(qMalloc(aalloc * sizeof(T)));
+        Q_CHECK_PTR(ptr);
         if (ptr) {
+            s = 0;
             a = aalloc;
 
             if (QTypeInfo<T>::isStatic) {
-                T *i = ptr + osize;
-                T *j = oldPtr + osize;
-                while (i != ptr) {
-                    new (--i) T(*--j);
-                    j->~T();
+                QT_TRY {
+                    while (s < asize) {
+                        new (ptr+s) T(*(oldPtr+s));
+                        (oldPtr+s)->~T();
+                        s++;
+                    }
+                } QT_CATCH(...) {
+                    // clean up all the old objects and then free the old ptr
+                    int sClean = s;
+                    while (sClean < osize)
+                        (oldPtr+(sClean++))->~T();
+                    if (oldPtr != reinterpret_cast<T *>(array) && oldPtr != ptr)
+                        qFree(oldPtr);
+                    QT_RETHROW;
                 }
             } else {
-                qMemCopy(ptr, oldPtr, osize * sizeof(T));
+                qMemCopy(ptr, oldPtr, qMin(asize, osize) * sizeof(T));
+                s = asize;
             }
         } else {
             ptr = oldPtr;
-            s = 0;
-            asize = 0;
+            return;
         }
     }
 
     if (QTypeInfo<T>::isComplex) {
-        if (asize < osize) {
-            T *i = oldPtr + osize;
-            T *j = oldPtr + asize;
-            while (i-- != j)
-                i->~T();
-        } else {
-            T *i = ptr + asize;
-            T *j = ptr + osize;
-            while (i != j)
-                new (--i) T;
-        }
+        while (osize > asize)
+            (oldPtr+(--osize))->~T();
+        if( oldPtr == ptr )
+            s = osize;
     }
 
     if (oldPtr != reinterpret_cast<T *>(array) && oldPtr != ptr)
         qFree(oldPtr);
+
+    if (QTypeInfo<T>::isComplex) {
+        // call default constructor for new objects (which can throw)
+        while (s < asize)
+            new (ptr+(s++)) T;
+    } else {
+        s = asize;
+    }
 }
 
 QT_END_NAMESPACE
diff --git a/src/corelib/tools/qvector.cpp b/src/corelib/tools/qvector.cpp
index 6b26b2e..04e9ace 100644
--- a/src/corelib/tools/qvector.cpp
+++ b/src/corelib/tools/qvector.cpp
@@ -50,6 +50,7 @@ QVectorData QVectorData::shared_null = { Q_BASIC_ATOMIC_INITIALIZER(1), 0, 0, tr
 QVectorData *QVectorData::malloc(int sizeofTypedData, int size, int sizeofT, QVectorData *init)
 {
     QVectorData* p = (QVectorData *)qMalloc(sizeofTypedData + (size - 1) * sizeofT);
+    Q_CHECK_PTR(p);
     ::memcpy(p, init, sizeofTypedData + (qMin(size, init->alloc) - 1) * sizeofT);
     return p;
 }
diff --git a/src/corelib/tools/qvector.h b/src/corelib/tools/qvector.h
index 1f047b8..610b8e7 100644
--- a/src/corelib/tools/qvector.h
+++ b/src/corelib/tools/qvector.h
@@ -77,6 +77,7 @@ struct Q_CORE_EXPORT QVectorData
     static QVectorData shared_null;
     // ### Qt 5: rename to 'allocate()'. The current name causes problems for
     // some debugges when the QVector is member of a class within an unnamed namespace.
+    // ### Qt 5: can be removed completely. (Ralf)
     static QVectorData *malloc(int sizeofTypedData, int size, int sizeofT, QVectorData *init);
     static int grow(int sizeofTypedData, int size, int sizeofT, bool excessive);
 };
@@ -379,7 +380,9 @@ QVector<T> &QVector<T>::operator=(const QVector<T> &v)
 template <typename T>
 inline QVectorData *QVector<T>::malloc(int aalloc)
 {
-    return static_cast<QVectorData *>(qMalloc(sizeOfTypedData() + (aalloc - 1) * sizeof(T)));
+    QVectorData *data = static_cast<QVectorData *>(qMalloc(sizeOfTypedData() + (aalloc - 1) * sizeof(T)));
+    Q_CHECK_PTR(data);
+    return data;
 }
 
 template <typename T>
@@ -428,74 +431,79 @@ void QVector<T>::free(Data *x)
 template <typename T>
 void QVector<T>::realloc(int asize, int aalloc)
 {
-    T *j, *i, *b;
+    T *pOld;
+    T *pNew;
     union { QVectorData *p; Data *d; } x;
     x.d = d;
 
-    if (QTypeInfo<T>::isComplex && aalloc == d->alloc && d->ref == 1) {
-        // pure resize
-        i = d->array + d->size;
-        j = d->array + asize;
-        if (i > j) {
-            while (i-- != j)
-                i->~T();
-        } else {
-            while (j-- != i)
-                new (j) T;
+    if (QTypeInfo<T>::isComplex && asize < d->size && d->ref == 1 ) {
+        // call the destructor on all objects that need to be
+        // destroyed when shrinking
+        pOld = d->array + d->size;
+        pNew = d->array + asize;
+        while (asize < d->size) {
+            (--pOld)->~T();
+            d->size--;
         }
-        d->size = asize;
-        return;
     }
 
     if (aalloc != d->alloc || d->ref != 1) {
         // (re)allocate memory
         if (QTypeInfo<T>::isStatic) {
             x.p = malloc(aalloc);
+            Q_CHECK_PTR(x.p);
+            x.d->size = 0;
         } else if (d->ref != 1) {
-            x.p = QVectorData::malloc(sizeOfTypedData(), aalloc, sizeof(T), p);
-        } else {
+            x.p = malloc(aalloc);
+            Q_CHECK_PTR(x.p);
             if (QTypeInfo<T>::isComplex) {
-                // call the destructor on all objects that need to be
-                // destroyed when shrinking
-                if (asize < d->size) {
-                    j = d->array + asize;
-                    i = d->array + d->size;
-                    while (i-- != j)
-                        i->~T();
-                    i = d->array + asize;
-                }
+                x.d->size = 0;
+            } else {
+                ::memcpy(x.p, p, sizeOfTypedData() + (qMin(aalloc, p->alloc) - 1) * sizeof(T));
+                x.d->size = d->size;
+            }
+        } else {
+            QT_TRY {
+                QVectorData *mem = static_cast<QVectorData *>(qRealloc(p, sizeOfTypedData() + (aalloc - 1) * sizeof(T)));
+                Q_CHECK_PTR(mem);
+                x.p = p = mem;
+                x.d->size = d->size;
+            } QT_CATCH (const std::bad_alloc &) {
+                if (aalloc > d->alloc) // ignore the error in case we are just shrinking.
+                    QT_RETHROW;
             }
-            x.p = p = static_cast<QVectorData *>(qRealloc(p, sizeOfTypedData() + (aalloc - 1) * sizeof(T)));
         }
         x.d->ref = 1;
+        x.d->alloc = aalloc;
         x.d->sharable = true;
         x.d->capacity = d->capacity;
-
     }
+
     if (QTypeInfo<T>::isComplex) {
-        if (asize < d->size) {
-            j = d->array + asize;
-            i = x.d->array + asize;
-        } else {
-            // construct all new objects when growing
-            i = x.d->array + asize;
-            j = x.d->array + d->size;
-            while (i != j)
-                new (--i) T;
-            j = d->array + d->size;
-        }
-        if (i != j) {
+        QT_TRY {
+            pOld = d->array + x.d->size;
+            pNew = x.d->array + x.d->size;
             // copy objects from the old array into the new array
-            b = x.d->array;
-            while (i != b)
-                new (--i) T(*--j);
+            while (x.d->size < qMin(asize, d->size)) {
+                new (pNew++) T(*pOld++);
+                x.d->size++;
+            }
+            // construct all new objects when growing
+            while (x.d->size < asize) {
+                new (pNew++) T;
+                x.d->size++;
+            }
+        } QT_CATCH (...) {
+            free(x.d);
+            QT_RETHROW;
         }
-    } else if (asize > d->size) {
+
+    } else if (asize > x.d->size) {
         // initialize newly allocated memory to 0
-        qMemSet(x.d->array + d->size, 0, (asize - d->size) * sizeof(T));
+        qMemSet(x.d->array + x.d->size, 0, (asize - x.d->size) * sizeof(T));
     }
     x.d->size = asize;
-    x.d->alloc = aalloc;
+
     if (d != x.d) {
         if (!d->ref.deref())
             free(d);
diff --git a/src/corelib/tools/tools.pri b/src/corelib/tools/tools.pri
index c2381ce..8d27100 100644
--- a/src/corelib/tools/tools.pri
+++ b/src/corelib/tools/tools.pri
@@ -36,7 +36,8 @@ HEADERS +=  \
 	tools/qtimeline.h \
 	tools/qunicodetables_p.h \
 	tools/qvarlengtharray.h \
-	tools/qvector.h
+	tools/qvector.h \
+        tools/qscopedpointer.h
 
 
 SOURCES += \