4 files changed, 42 insertions, 12 deletions

diff --git a/src/qml/common/qqmljsmemorypool_p.h b/src/qml/common/qqmljsmemorypool_p.h
index 0cf7ea84e6..1b81a87a2c 100644
--- a/src/qml/common/qqmljsmemorypool_p.h
+++ b/src/qml/common/qqmljsmemorypool_p.h
@@ -87,7 +87,7 @@ public:
     inline void *allocate(size_t size)
     {
         size = (size + 7) & ~size_t(7);
-        if (Q_LIKELY(_ptr && (_ptr + size < _end))) {
+        if (Q_LIKELY(_ptr && size < size_t(_end - _ptr))) {
             void *addr = _ptr;
             _ptr += size;
             return addr;
diff --git a/src/qml/jsruntime/qv4arraydata.cpp b/src/qml/jsruntime/qv4arraydata.cpp
index 0eea3345c5..9816a646de 100644
--- a/src/qml/jsruntime/qv4arraydata.cpp
+++ b/src/qml/jsruntime/qv4arraydata.cpp
@@ -670,8 +670,8 @@ bool ArrayElementLessThan::operator()(Value v1, Value v2) const
     return p1s->toQString() < p2s->toQString();
 }
 
-template <typename RandomAccessIterator, typename T, typename LessThan>
-void sortHelper(RandomAccessIterator start, RandomAccessIterator end, const T &t, LessThan lessThan)
+template <typename RandomAccessIterator, typename LessThan>
+void sortHelper(RandomAccessIterator start, RandomAccessIterator end, LessThan lessThan)
 {
 top:
     int span = int(end - start);
@@ -716,7 +716,7 @@ top:
         ++low;
 
     qSwap(*end, *low);
-    sortHelper(start, low, t, lessThan);
+    sortHelper(start, low, lessThan);
 
     start = low + 1;
     ++end;
@@ -816,8 +816,36 @@ void ArrayData::sort(ExecutionEngine *engine, Object *thisObject, const Value &c
 
     ArrayElementLessThan lessThan(engine, static_cast<const FunctionObject &>(comparefn));
 
-    Value *begin = thisObject->arrayData()->values.values;
-    sortHelper(begin, begin + len, *begin, lessThan);
+    const auto thisArrayData = thisObject->arrayData();
+    uint startIndex = thisArrayData->mappedIndex(0);
+    uint endIndex = thisArrayData->mappedIndex(len - 1) + 1;
+    if (startIndex < endIndex) {
+        // Values are contiguous. Sort right away.
+        sortHelper(
+                thisArrayData->values.values + startIndex,
+                thisArrayData->values.values + endIndex,
+                lessThan);
+    } else {
+        // Values wrap around the end of the allocation. Close the gap to form a contiguous array.
+        // We're going to sort anyway. So we don't need to care about order.
+
+        // ArrayElementLessThan sorts empty and undefined to the end of the array anyway, but we
+        // probably shouldn't rely on the unused slots to be actually undefined or empty.
+
+        const uint gap = startIndex - endIndex;
+        const uint allocEnd = thisArrayData->values.alloc - 1;
+        for (uint i = 0; i < gap; ++i) {
+            const uint from = allocEnd - i;
+            const uint to = endIndex + i;
+            if (from < startIndex)
+                break;
+
+            std::swap(thisArrayData->values.values[from], thisArrayData->values.values[to]);
+        }
+
+        thisArrayData->offset = 0;
+        sortHelper(thisArrayData->values.values, thisArrayData->values.values + len, lessThan);
+    }
 
 #ifdef CHECK_SPARSE_ARRAYS
     thisObject->initSparseArray();
diff --git a/src/qml/qml/ftw/qintrusivelist_p.h b/src/qml/qml/ftw/qintrusivelist_p.h
index 8992be9f93..e7ae83c38d 100644
--- a/src/qml/qml/ftw/qintrusivelist_p.h
+++ b/src/qml/qml/ftw/qintrusivelist_p.h
@@ -241,7 +241,12 @@ typename QIntrusiveList<N, member>::iterator QIntrusiveList<N, member>::end()
 template<class N, QIntrusiveListNode N::*member>
 N *QIntrusiveList<N, member>::nodeToN(QIntrusiveListNode *node)
 {
+    QT_WARNING_PUSH
+#if defined(Q_CC_CLANG) && ((__clang_major__ * 100) + __clang_minor__) >= 1300
+    QT_WARNING_DISABLE_CLANG("-Wnull-pointer-subtraction")
+#endif
     return (N *)((char *)node - ((char *)&(((N *)nullptr)->*member) - (char *)nullptr));
+    QT_WARNING_POP
 }
 
 QIntrusiveListNode::QIntrusiveListNode()
diff --git a/src/qml/qml/ftw/qrecyclepool_p.h b/src/qml/qml/ftw/qrecyclepool_p.h
index 39f4f88512..c963e1878e 100644
--- a/src/qml/qml/ftw/qrecyclepool_p.h
+++ b/src/qml/qml/ftw/qrecyclepool_p.h
@@ -130,8 +130,7 @@ template<typename T, int Step>
 T *QRecyclePool<T, Step>::New()
 {
     T *rv = d->allocate();
-    new (rv) T;
-    return rv;
+    return new (rv) T;
 }
 
 template<typename T, int Step>
@@ -139,8 +138,7 @@ template<typename T1>
 T *QRecyclePool<T, Step>::New(const T1 &a)
 {
     T *rv = d->allocate();
-    new (rv) T(a);
-    return rv;
+    return new (rv) T(a);
 }
 
 template<typename T, int Step>
@@ -148,8 +146,7 @@ template<typename T1>
 T *QRecyclePool<T, Step>::New(T1 &a)
 {
     T *rv = d->allocate();
-    new (rv) T(a);
-    return rv;
+    return new (rv) T(a);
 }
 
 template<typename T, int Step>