Fix a crash in JSON.parse

Properly set members that are actually array indices
and don't crash when trying to set those.

Task-number: QTBUG-35383
Change-Id: I04d4b65c27e97a2e9db19541ed46ee1bb202f780
Reviewed-by: Simon Hausmann <[email protected]>
Reviewed-by: Milian Wolff <[email protected]>

1 files changed, 7 insertions, 2 deletions

diff --git a/src/qml/jsruntime/qv4jsonobject.cpp b/src/qml/jsruntime/qv4jsonobject.cpp
index 458b46b36e..5aac8c8197 100644
--- a/src/qml/jsruntime/qv4jsonobject.cpp
+++ b/src/qml/jsruntime/qv4jsonobject.cpp
@@ -284,8 +284,13 @@ bool JsonParser::parseMember(ObjectRef o)
         return false;
 
     ScopedString s(scope, context->engine->newIdentifier(key));
-    Property *p = o->insertMember(s, Attr_Data);
-    p->value = val.asReturnedValue();
+    uint idx = s->asArrayIndex();
+    if (idx < UINT_MAX) {
+        o->putIndexed(idx, val);
+    } else {
+        Property *p = o->insertMember(s, Attr_Data);
+        p->value = val.asReturnedValue();
+    }
 
     END;
     return true;