QVarLengthArray: assert that the range passed to erase() is valid

We already checked that the two iterators, indvidually, are valid, but
we didn't check that the range formed by them is valid, namely that
the end iterator is reachable from the start iterator.

Add an assert, because if the range isn't valid, we run into UB in the
std::move() algorithm two lines later.

Qt 5.15 uses std::copy() here, which has the same precondition, so the
assertion would make sense there, too.

Change-Id: I90b7e846455ff86383a8971bea908036684961d8
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
(cherry picked from commit c38639089f0e17a3da40dca03fecac88f5d89ba9)
Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>

1 files changed, 2 insertions, 0 deletions

diff --git a/src/corelib/tools/qvarlengtharray.h b/src/corelib/tools/qvarlengtharray.h
index 125012e54b..248f90af01 100644
--- a/src/corelib/tools/qvarlengtharray.h
+++ b/src/corelib/tools/qvarlengtharray.h
@@ -541,6 +541,8 @@ Q_OUTOFLINE_TEMPLATE typename QVarLengthArray<T, Prealloc>::iterator QVarLengthA
     if (n == 0) // avoid UB in std::copy() below
         return data() + f;
 
+    Q_ASSERT(n > 0); // aend must be reachable from abegin
+
     if (QTypeInfo<T>::isComplex) {
         std::copy(ptr + l, ptr + s, QT_MAKE_CHECKED_ARRAY_ITERATOR(ptr + f, s - f));
         T *i = ptr + s;