Problems with JS array sorting after unshift

Array sorting does not work correctly after doing an unshift to an array. In Qt 5.6.1, there is a crash (the array objects become managed objects that are null pointers - the _val of the Value struct is 0). This leads to an assertion failure and a crash. The array contents can be correctly stringified before and during the sort, but objects a and b are printed as "undefined".

On Qt 5.8.0, there is no longer crash, but the sort still behaves incorrectly. In the attached sample, the sort function is not called until there are five elements in the array, and even then, it is only called once. At least superficially, the sorting seems to work after there are six or more elements. When using the push function instead, it looks like the function works correctly. The length of the array is reported correctly in the length property, but I don't know if in some cases another mechanism is used internally. Also, some objecs are incorrectly reported as null when stringifying the objectArr - but curiously they are then correctly passed to the sort function. This seems to be almost the opposite of the Qt 5.6.1 behavior.

I did not observe the issue on 32-bit MinGW Qt version 5.6.1 on Windows (I did not test other combinations on Windows). None of these issues were present with Qt 5.2.1, so this seems to be regression from an older version.