Fix crash in qqmlecmascript::sequenceSort with MSVC in debug builds

ArrayPrototype.sort allows specifying a compare function implemented in JS,
which we "wrap" and then pass on to std::sort. std::sort with MSVC has
an assertion verifying that the less-than compare function provided is
perfectly consistent in its return values. We don't want JS to easily crash
the entire application and therefore resort to qSort().

Change-Id: Id2c758a7d2bee60f31a7a3971172bca9b3c69af6
Reviewed-by: Lars Knoll <lars.knoll@digia.com>

diff --git a/src/qml/qml/v4/qv4object.cpp b/src/qml/qml/v4/qv4object.cpp
index fa8813b..1849cc8 100644 (file)
--- a/src/qml/qml/v4/qv4object.cpp
+++ b/src/qml/qml/v4/qv4object.cpp
@@ -1166,7 +1166,13 @@ void Object::arraySort(ExecutionContext *context, Object *thisObject, const Valu
     ArrayElementLessThan lessThan(context, thisObject, comparefn);
 
     Property *begin = arrayData;
-    std::sort(begin, begin + len, lessThan);
+    // We deliberately choose qSort over std::sort here, because with
+    // MSVC in debug builds, std::sort has an ASSERT() that verifies
+    // that the return values of lessThan are perfectly consistent
+    // and aborts otherwise. We do not want JavaScript to easily crash
+    // the entire application and therefore choose qSort, which doesn't
+    // have this property.
+    qSort(begin, begin + len, lessThan);
 }