V4: Fix SparseArray::deleteNode

SparseArray::deleteNode should modify size_left only if
the deleted node had a right child

Change-Id: I0f3504a5c6568dbd9e392bf83eaf3f9780eb2b84
Task-number: QTBUG-46022
Reviewed-by: Simon Hausmann <simon.hausmann@theqtcompany.com>

src/qml/jsruntime/qv4sparsearray.cpp

@@ -246,15 +246,12 @@ void SparseArray::deleteNode(SparseArrayNode *z)
             x->setParent(y->parent());
         if (root == y)
             root = x;
-        else if (y->parent()->left == y) {
+        else if (y->parent()->left == y)
             y->parent()->left = x;
-            if (x)
+        else
-                x->size_left += y->size_left;
-        } else {
             y->parent()->right = x;
-            if (x)
+        if (x && x == y->right)
-                x->size_left += y->size_left;
+            x->size_left += y->size_left;
-        }
         y->size_left = 0;
     }
     if (y->color() != SparseArrayNode::Red) {

tests/auto/qml/qqmlecmascript/data/qtbug_46022.js

@@ -0,0 +1,21 @@
+var obj = {}
+obj[5289] = 0
+obj[5290] = 0
+obj[5288] = 0
+obj[5287] = 0
+delete obj[5288]
+
+var a = Object.getOwnPropertyNames(obj)
+var test1 = a.every(function(key) {
+  return obj.hasOwnProperty(key)
+})
+
+obj = {}
+obj[8187] = 0
+obj[8188] = 0
+delete obj[8187]
+
+var b = Object.getOwnPropertyNames(obj)
+var test2 = b.every(function(key) {
+  return obj.hasOwnProperty(key)
+})

tests/auto/qml/qqmlecmascript/data/qtbug_46022.qml

@@ -0,0 +1,7 @@
+import "qtbug_46022.js" as Test
+import QtQuick 2.0
+
+QtObject {
+    property bool test1: Test.test1
+    property bool test2: Test.test2
+}

tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp

@@ -326,6 +326,7 @@ private slots:
     void readUnregisteredQObjectProperty();
     void writeUnregisteredQObjectProperty();
     void switchExpression();
+    void qtbug_46022();
 
 private:
 //    static void propertyVarWeakRefCallback(v8::Persistent<v8::Value> object, void* parameter);
@@ -7878,6 +7879,16 @@ void tst_qqmlecmascript::switchExpression()
     QCOMPARE(v.toBool(), true);
 }
 
+void tst_qqmlecmascript::qtbug_46022()
+{
+    QQmlComponent component(&engine, testFileUrl("qtbug_46022.qml"));
+
+    QScopedPointer<QObject> obj(component.create());
+    QVERIFY(obj != 0);
+    QCOMPARE(obj->property("test1").toBool(), true);
+    QCOMPARE(obj->property("test2").toBool(), true);
+}
+
 QTEST_MAIN(tst_qqmlecmascript)
 
 #include "tst_qqmlecmascript.moc"