From 9e83d268d6e0bd492fafad823a47cef57b7916c5 Mon Sep 17 00:00:00 2001
From: Eirik Aavitsland <eirik.aavitsland@qt.io>
Date: Wed, 22 Apr 2020 20:06:16 +0200
Subject: [PATCH] Fix data corruption regression in QJsonObject::erase()

The internal removeAt(index) method was implemented as taking cbor
indexes directly, in contrast to the other ...At(index) methods.

Fixes: QTBUG-83695
Change-Id: I16597eb6db1cf71e1585c041caa81bf8f7a75303
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
---
 src/corelib/serialization/qjsonobject.cpp            | 8 ++++----
 tests/auto/corelib/serialization/json/tst_qtjson.cpp | 7 +++++++
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/src/corelib/serialization/qjsonobject.cpp b/src/corelib/serialization/qjsonobject.cpp
index 850e878571f..36429662fc1 100644
--- a/src/corelib/serialization/qjsonobject.cpp
+++ b/src/corelib/serialization/qjsonobject.cpp
@@ -577,7 +577,7 @@ void QJsonObject::removeImpl(T key)
     if (!keyExists)
         return;
 
-    removeAt(index);
+    removeAt(index / 2);
 }
 
 #if QT_STRINGVIEW_LEVEL < 2
@@ -629,7 +629,7 @@ QJsonValue QJsonObject::takeImpl(T key)
         return QJsonValue(QJsonValue::Undefined);
 
     const QJsonValue v = QJsonPrivate::Value::fromTrustedCbor(o->extractAt(index + 1));
-    removeAt(index);
+    removeAt(index / 2);
     return v;
 }
 
@@ -1486,8 +1486,8 @@ void QJsonObject::setValueAt(int i, const QJsonValue &val)
 void QJsonObject::removeAt(int index)
 {
     detach2();
-    o->removeAt(index + 1);
-    o->removeAt(index);
+    o->removeAt(2 * index + 1);
+    o->removeAt(2 * index);
 }
 
 uint qHash(const QJsonObject &object, uint seed)
diff --git a/tests/auto/corelib/serialization/json/tst_qtjson.cpp b/tests/auto/corelib/serialization/json/tst_qtjson.cpp
index 7da20772f80..e5d909b9a7d 100644
--- a/tests/auto/corelib/serialization/json/tst_qtjson.cpp
+++ b/tests/auto/corelib/serialization/json/tst_qtjson.cpp
@@ -927,9 +927,16 @@ void tst_QtJson::testObjectIteration()
         QCOMPARE(object, object2);
 
         QJsonObject::iterator it = object2.find(QString::number(5));
+        QJsonValue val = *it;
         object2.erase(it);
         QCOMPARE(object.size(), 10);
         QCOMPARE(object2.size(), 9);
+
+        for (QJsonObject::const_iterator it = object2.constBegin(); it != object2.constEnd(); ++it) {
+            QJsonValue value = it.value();
+            QVERIFY(it.value() != val);
+            QCOMPARE((double)it.key().toInt(), value.toDouble());
+        }
     }
 
     {