Crash when copy-dragging text beyond the end of a dext document

Selecting text in a QTextEdit, copy-dragging the text (CRTL/ALT + drag) beyond the end of the text document and dropping it there causes a crash.

QTextEngine::items is accessed wit hindex -1. It seems that commit be0bfe09ee4b99e9ab45c6898949b5d144e77a29 has something to do with it. Perhaps QTextLine::cursorToX needs to handle the -1 somehow.

003a22fc 5af846a6 Qt5Cored!qt_message_fatal(QtMsgType __formal = QtFatalMsg (0n3), class QMessageLogContext * context = 0x003a2358, class QString * message = 0x003a2324)+0xa1 [c:\users\aportale\dev\qt5\qtbase\src\corelib\global\qlogging.cpp @ 1309]
003a2338 5af7bc88 Qt5Cored!QMessageLogger::fatal(char * msg = 0x5b43d1a8 "ASSERT failure in %s: "%s", file %s, line %d")+0x96 [c:\users\aportale\dev\qt5\qtbase\src\corelib\global\qlogging.cpp @ 597]
003a236c 5a963764 Qt5Cored!qt_assert_x(char * where = 0x5ad18f38 "QVector<T>::operator[]", char * what = 0x5ad01510 "index out of range", char * file = 0x5ad04e30 "c:\users\aportale\dev\qt5-build-dev\qtbase\include\qtcore\../../../../qt5/qtbase/src/corelib/tools/qvector.h", int line = 0n404)+0x38 [c:\users\aportale\dev\qt5\qtbase\src\corelib\global\qglobal.cpp @ 2686]
003a238c 5aa40dc9 Qt5Guid!QVector<QScriptItem>::operator[](int i = 0n-1)+0x44 [c:\users\aportale\dev\qt5\qtbase\src\corelib\tools\qvector.h @ 404]
003a29d8 5a967167 Qt5Guid!QTextLine::cursorToX(int * cursorPos = 0x003a29f4, QTextLine::Edge edge = Leading (0n0))+0x1a9 [c:\users\aportale\dev\qt5\qtbase\src\gui\text\qtextlayout.cpp @ 2584]
003a29ec 5badb88e Qt5Guid!QTextLine::cursorToX(int cursorPos = 0n136, QTextLine::Edge edge = Leading (0n0))+0x17 [c:\users\aportale\dev\qt5\qtbase\src\gui\text\qtextlayout.h @ 233]
003a2b20 5badb6f1 Qt5Widgetsd!QWidgetTextControlPrivate::rectForPosition(int position = 0n136)+0x17e [c:\users\aportale\dev\qt5\qtbase\src\widgets\widgets\qwidgettextcontrol.cpp @ 1431]
003a2b78 5bada9b7 Qt5Widgetsd!QWidgetTextControlPrivate::cursorRectPlusUnicodeDirectionMarkers(class QTextCursor * cursor = 0x0049c920)+0x81 [c:\users\aportale\dev\qt5\qtbase\src\widgets\widgets\qwidgettextcontrol.cpp @ 2317]
003a2bb0 5bad8fc4 Qt5Widgetsd!QWidgetTextControlPrivate::repaintCursor(void)+0x27 [c:\users\aportale\dev\qt5\qtbase\src\widgets\widgets\qwidgettextcontrol.cpp @ 555]
003a2bd0 5b2aafeb Qt5Widgetsd!QWidgetTextControl::timerEvent(class QTimerEvent * e = 0x003a3320)+0xb4 [c:\users\aportale\dev\qt5\qtbase\src\widgets\widgets\qwidgettextcontrol.cpp @ 1200]
003a2c88 5bad9014 Qt5Cored!QObject::event(class QEvent * e = 0x003a3320)+0x6b [c:\users\aportale\dev\qt5\qtbase\src\corelib\kernel\qobject.cpp @ 1231]
003a2c98 5b874e9e Qt5Widgetsd!QWidgetTextControl::event(class QEvent * e = 0x003a3320)+0x14 [c:\users\aportale\dev\qt5\qtbase\src\widgets\widgets\qwidgettextcontrol.cpp @ 1188]
003a2cb8 5b871389 Qt5Widgetsd!QApplicationPrivate::notify_helper(class QObject * receiver = 0x0049c710, class QEvent * e = 0x003a3320)+0xfe [c:\users\aportale\dev\qt5\qtbase\src\widgets\kernel\qapplication.cpp @ 3749]
003a32b4 5b25fa07 Qt5Widgetsd!QApplication::notify(class QObject * receiver = 0x0049c710, class QEvent * e = 0x003a3320)+0x4f9 [c:\users\aportale\dev\qt5\qtbase\src\widgets\kernel\qapplication.cpp @ 3202]
003a32f8 5b267cb9 Qt5Cored!QCoreApplication::notifyInternal(class QObject * receiver = 0x0049c710, class QEvent * event = 0x003a3320)+0x97 [c:\users\aportale\dev\qt5\qtbase\src\corelib\kernel\qcoreapplication.cpp @ 940]
003a330c 5b2f8a78 Qt5Cored!QCoreApplication::sendEvent(class QObject * receiver = 0x0049c710, class QEvent * event = 0x003a3320)+0x39 [c:\users\aportale\dev\qt5\qtbase\src\corelib\kernel\qcoreapplication.h @ 236]
003a3344 5b2f673d Qt5Cored!QEventDispatcherWin32Private::sendTimerEvent(int timerId = 0n1)+0x78 [c:\users\aportale\dev\qt5\qtbase\src\corelib\kernel\qeventdispatcher_win.cpp @ 621]
003a33f0 756a7834 Qt5Cored!qt_internal_proc(struct HWND__ * hwnd = 0x00030650 0+0+140x39 'QEventDispatcherWin32_Internal_Widget1525822437', unsigned int message = 0x113, unsigned int wp = 1, long lp = 0n0)+0x32d [c:\users\aportale\dev\qt5\qtbase\src\corelib\kernel\qeventdispatcher_win.cpp @ 425]