4 files changed, 38 insertions, 18 deletions
diff --git a/src/qml/compiler/qv4ssa.cpp b/src/qml/compiler/qv4ssa.cpp
index 673d4e5db0..8488d6eb2b 100644
--- a/src/qml/compiler/qv4ssa.cpp
+++ b/src/qml/compiler/qv4ssa.cpp
@@ -141,13 +141,31 @@ public:
                 if (set.blockNumbers)
                     numberIt = set.blockNumbers->begin();
                 else
-                    flagIt = std::distance(set.blockFlags->begin(),
-                                           std::find(set.blockFlags->begin(),
-                                                     set.blockFlags->end(),
-                                                     true));
+                    findNextWithFlags(0);
             }
         }
 
+        void findNextWithFlags(size_t start)
+        {
+            flagIt = std::distance(set.blockFlags->begin(),
+                                   std::find(set.blockFlags->begin() + start,
+                                             set.blockFlags->end(),
+                                             true));
+
+            // The ++operator of std::vector<bool>::iterator in libc++ has a bug when using it on an
+            // iterator pointing to the last element. It will not be set to ::end(), but beyond
+            // that. (It will be set to the first multiple of the native word size that is bigger
+            // than size().)
+            //
+            // See http://llvm.org/bugs/show_bug.cgi?id=19663
+            //
+            // As we use the size to for our end() iterator, take the minimum of the size and the
+            // distance for the flagIt:
+            flagIt = qMin(flagIt, set.blockFlags->size());
+
+            Q_ASSERT(flagIt <= set.blockFlags->size());
+        }
+
     public:
         BasicBlock *operator*() const
         {
@@ -175,17 +193,10 @@ public:
 
         const_iterator &operator++()
         {
-            if (set.blockNumbers) {
-                if (numberIt != set.blockNumbers->end())
-                    ++numberIt;
-            } else if (flagIt < set.blockFlags->size()) {
-                flagIt = std::distance(set.blockFlags->begin(),
-                                       std::find(set.blockFlags->begin() + flagIt + 1,
-                                                 set.blockFlags->end(),
-                                                 true));
-                if (flagIt > set.blockFlags->size())
-                    flagIt = set.blockFlags->size();
-            }
+            if (set.blockNumbers)
+                ++numberIt;
+            else
+                findNextWithFlags(flagIt + 1);
 
             return *this;
         }
diff --git a/src/qml/jsruntime/qv4arrayobject.cpp b/src/qml/jsruntime/qv4arrayobject.cpp
index 838c541900..abe8a44065 100644
--- a/src/qml/jsruntime/qv4arrayobject.cpp
+++ b/src/qml/jsruntime/qv4arrayobject.cpp
@@ -366,7 +366,7 @@ ReturnedValue ArrayPrototype::method_shift(CallContext *ctx)
 
     ScopedValue result(scope);
 
-    if (!instance->protoHasArray() && !instance->arrayData()->hasAttributes() && instance->arrayData()->length() <= len) {
+    if (!instance->protoHasArray() && !instance->arrayData()->hasAttributes() && instance->arrayData()->length() <= len && instance->arrayData()->type() != ArrayData::Custom) {
         result = instance->arrayData()->vtable()->pop_front(instance.getPointer());
     } else {
         result = instance->getIndexed(0);
@@ -545,7 +545,7 @@ ReturnedValue ArrayPrototype::method_unshift(CallContext *ctx)
 
     uint len = instance->getLength();
 
-    if (!instance->protoHasArray() && !instance->arrayData()->hasAttributes() && instance->arrayData()->length() <= len) {
+    if (!instance->protoHasArray() && !instance->arrayData()->hasAttributes() && instance->arrayData()->length() <= len && instance->arrayData()->type() != ArrayData::Custom) {
         instance->arrayData()->vtable()->push_front(instance.getPointer(), ctx->d()->callData->args, ctx->d()->callData->argc);
     } else {
         ScopedValue v(scope);
diff --git a/src/qml/jsruntime/qv4engine.cpp b/src/qml/jsruntime/qv4engine.cpp
index f2cfc3efd2..7be518916d 100644
--- a/src/qml/jsruntime/qv4engine.cpp
+++ b/src/qml/jsruntime/qv4engine.cpp
@@ -851,7 +851,11 @@ void ExecutionEngine::markObjects()
 
     ExecutionContext *c = currentContext();
     while (c) {
-        c->mark(this);
+        Q_ASSERT(c->inUse());
+        if (!c->markBit()) {
+            c->d()->markBit = 1;
+            c->markObjects(c, this);
+        }
         c = c->d()->parent;
     }
 
diff --git a/src/qml/qml/qqmlcomponent.cpp b/src/qml/qml/qqmlcomponent.cpp
index 40b6a34f07..616f54d174 100644
--- a/src/qml/qml/qqmlcomponent.cpp
+++ b/src/qml/qml/qqmlcomponent.cpp
@@ -780,6 +780,11 @@ QQmlComponent::QQmlComponent(QQmlComponentPrivate &dd, QObject *parent)
 
     The ownership of the returned object instance is transferred to the caller.
 
+    If the object being created from this component is a visual item, it must
+    have a visual parent, which can be set by calling
+    QQuickItem::setParentItem(). See \l {Concepts - Visual Parent in Qt Quick}
+    for more details.
+
     \sa QQmlEngine::ObjectOwnership
 */
 QObject *QQmlComponent::create(QQmlContext *context)