Fix crash in QMetaProperty::write for custom types and conversion

if t >= QMetaType::User, we would not return false nor call convert.
We would then pass a pointer to whatever is in the QVariant to the
qt_metacall that is expecting a pointer to an object of a different type.

Since we have custom converters, we can call QVarent::convert even for
custom types anyway.

[ChangeLog][QtCore] Fixed crash when setting a QVariant of a different
type to a property of a custom type. Attempt to do a conversion instead.

Task-number: QTBUG-40644
Change-Id: Ib6fbd7e7ddcf25c5ee247ea04177e079f6d7de35
Reviewed-by: Jędrzej Nowacki <jedrzej.nowacki@theqtcompany.com>

1 files changed, 2 insertions, 2 deletions

diff --git a/src/corelib/kernel/qmetaobject.cpp b/src/corelib/kernel/qmetaobject.cpp
index f1ad74efb4..6abec27684 100644
--- a/src/corelib/kernel/qmetaobject.cpp
+++ b/src/corelib/kernel/qmetaobject.cpp
@@ -1,7 +1,7 @@
 /****************************************************************************
 **
 ** Copyright (C) 2015 The Qt Company Ltd.
-** Copyright (C) 2014 Olivier Goffart <ogoffart@woboq.com>
+** Copyright (C) 2015 Olivier Goffart <ogoffart@woboq.com>
 ** Contact: http://www.qt.io/licensing/
 **
 ** This file is part of the QtCore module of the Qt Toolkit.
@@ -3068,7 +3068,7 @@ bool QMetaProperty::write(QObject *object, const QVariant &value) const
             if (t == QMetaType::UnknownType)
                 return false;
         }
-        if (t != QMetaType::QVariant && t != (uint)value.userType() && (t < QMetaType::User && !v.convert((QVariant::Type)t)))
+        if (t != QMetaType::QVariant && int(t) != value.userType() && !v.convert(t))
             return false;
     }