Here is another fun Array.sort crash, not unlike QTBUG-81106 (but this time on a simple non-sparse array). If I try to sort an array that contains a Symbol such as Symbol.iterator, the engine crashes.
This appears to happen because the fallback code for the array element comparators (e.g. ArrayElementLessThan, here at qv4arraydata.cpp:660) assumes that the object can be converted to a string — and if it can't, it uses the resulting nullptr anyways and tries to call p1s->toQString() on it.
|For Gerrit Dashboard: QTBUG-81108|
|285695,5||V4: Don't crash when sorting arrays with non-stringifyable entries||5.14||qt/qtdeclarative||Status: MERGED||+2||0|