4 files changed, 36 insertions, 0 deletions
diff --git a/tests/auto/qscriptclass/tst_qscriptclass.cpp b/tests/auto/qscriptclass/tst_qscriptclass.cpp
index b4dbe73..da6c76f 100644
--- a/tests/auto/qscriptclass/tst_qscriptclass.cpp
+++ b/tests/auto/qscriptclass/tst_qscriptclass.cpp
@@ -66,6 +66,7 @@ public:
 private slots:
     void newInstance();
     void getAndSetProperty();
+    void getProperty_invalidValue();
     void enumerate();
     void extension();
 };
@@ -741,6 +742,26 @@ void tst_QScriptClass::getAndSetProperty()
     QVERIFY(!obj1.property(bar).isValid());
 }
 
+void tst_QScriptClass::getProperty_invalidValue()
+{
+    QScriptEngine eng;
+    TestClass cls(&eng);
+    cls.addCustomProperty(eng.toStringHandle("foo"), QScriptClass::HandlesReadAccess,
+                          /*id=*/0, QScriptValue::ReadOnly, QScriptValue());
+    QScriptValue obj = eng.newObject(&cls);
+
+    QVERIFY(obj.property("foo").isUndefined());
+
+    eng.globalObject().setProperty("obj", obj);
+    QVERIFY(eng.evaluate("obj.hasOwnProperty('foo'))").toBool());
+    // The JS environment expects that a valid value is returned,
+    // otherwise we could crash.
+    QVERIFY(eng.evaluate("obj.foo").isUndefined());
+    QVERIFY(eng.evaluate("obj.foo + ''").isString());
+    QVERIFY(eng.evaluate("Object.getOwnPropertyDescriptor(obj, 'foo').value").isUndefined());
+    QVERIFY(eng.evaluate("Object.getOwnPropertyDescriptor(obj, 'foo').value +''").isString());
+}
+
 void tst_QScriptClass::enumerate()
 {
     QScriptEngine eng;
diff --git a/tests/auto/qscriptvalue/tst_qscriptvalue.cpp b/tests/auto/qscriptvalue/tst_qscriptvalue.cpp
index 639df36..53e2699 100644
--- a/tests/auto/qscriptvalue/tst_qscriptvalue.cpp
+++ b/tests/auto/qscriptvalue/tst_qscriptvalue.cpp
@@ -2253,6 +2253,19 @@ void tst_QScriptValue::getSetData()
     QVERIFY(!object.data().isValid());
 }
 
+void tst_QScriptValue::setData_QTBUG15144()
+{
+    QScriptEngine eng;
+    QScriptValue obj = eng.newObject();
+    for (int i = 0; i < 10000; ++i) {
+        // Create an object with property 'fooN' on it, and immediately kill
+        // the reference to the object so it and the property name become garbage.
+        eng.evaluate(QString::fromLatin1("o = {}; o.foo%0 = 10; o = null;").arg(i));
+        // Setting the data will cause a JS string to be allocated, which could
+        // trigger a GC. This should not cause a crash.
+        obj.setData("foodfight");
+    }
+}
 class TestScriptClass : public QScriptClass
 {
 public:
diff --git a/tests/auto/qscriptvalue/tst_qscriptvalue.h b/tests/auto/qscriptvalue/tst_qscriptvalue.h
index 462749a..aa6bc6c 100644
--- a/tests/auto/qscriptvalue/tst_qscriptvalue.h
+++ b/tests/auto/qscriptvalue/tst_qscriptvalue.h
@@ -216,6 +216,7 @@ private slots:
     void getSetProperty();
     void arrayElementGetterSetter();
     void getSetData();
+    void setData_QTBUG15144();
     void getSetScriptClass();
     void call();
     void construct();
diff --git a/tests/auto/qtextdocument/tst_qtextdocument.cpp b/tests/auto/qtextdocument/tst_qtextdocument.cpp
index 808299b..23f6a6c 100644
--- a/tests/auto/qtextdocument/tst_qtextdocument.cpp
+++ b/tests/auto/qtextdocument/tst_qtextdocument.cpp
@@ -2054,6 +2054,7 @@ void tst_QTextDocument::clonePreservesIndentWidth()
     doc->setIndentWidth(42);
     QTextDocument *clone = doc->clone();
     QCOMPARE(clone->indentWidth(), qreal(42));
+    delete clone;
 }
 
 void tst_QTextDocument::blockCount()