Fix crash when loading invalid QML with behavior on invalid group property

Behaviors require the creation of a meta-object. However when trying to
create a behavior on a non-existent group property, we don't have a
base meta-object to base the "new" meta-object on, therefore this patch
adds a null pointer check.

The error in the QML file itself will be caught later on. The added test
ensures that as well as that it doesn't crash of course.

Change-Id: If73116053464e7e69b02ef59e8387060835083c8
Task-number: QTBUG-40369
Reviewed-by: Sérgio Martins <sergio.martins@kdab.com>
Reviewed-by: Lars Knoll <lars.knoll@digia.com>

4 files changed, 15 insertions, 6 deletions

diff --git a/src/qml/compiler/qqmltypecompiler.cpp b/src/qml/compiler/qqmltypecompiler.cpp
index dacaa14a3d..f5cb5db369 100644
--- a/src/qml/compiler/qqmltypecompiler.cpp
+++ b/src/qml/compiler/qqmltypecompiler.cpp
@@ -541,12 +541,14 @@ bool QQmlPropertyCacheCreator::buildMetaObjectRecursively(int objectIndex, int r
         Q_ASSERT(baseTypeCache);
     }
 
-    if (needVMEMetaObject) {
-        if (!createMetaObject(objectIndex, obj, baseTypeCache))
-            return false;
-    } else if (baseTypeCache) {
-        propertyCaches[objectIndex] = baseTypeCache;
-        baseTypeCache->addref();
+    if (baseTypeCache) {
+        if (needVMEMetaObject) {
+            if (!createMetaObject(objectIndex, obj, baseTypeCache))
+                return false;
+        } else {
+            propertyCaches[objectIndex] = baseTypeCache;
+            baseTypeCache->addref();
+        }
     }
 
     if (propertyCaches.at(objectIndex)) {
diff --git a/tests/auto/qml/qqmllanguage/data/nonexistantProperty.8.errors.txt b/tests/auto/qml/qqmllanguage/data/nonexistantProperty.8.errors.txt
new file mode 100644
index 0000000000..b60b59b111
--- /dev/null
+++ b/tests/auto/qml/qqmllanguage/data/nonexistantProperty.8.errors.txt
@@ -0,0 +1 @@
+4:24:Cannot assign to non-existent property "root"
diff --git a/tests/auto/qml/qqmllanguage/data/nonexistantProperty.8.qml b/tests/auto/qml/qqmllanguage/data/nonexistantProperty.8.qml
new file mode 100644
index 0000000000..86c5f3bd7d
--- /dev/null
+++ b/tests/auto/qml/qqmllanguage/data/nonexistantProperty.8.qml
@@ -0,0 +1,5 @@
+import QtQuick 2.0
+Item {
+    id: root
+    NumberAnimation on root.opacity { duration: 1000 }
+}
diff --git a/tests/auto/qml/qqmllanguage/tst_qqmllanguage.cpp b/tests/auto/qml/qqmllanguage/tst_qqmllanguage.cpp
index 95d6eb9262..7976987b58 100644
--- a/tests/auto/qml/qqmllanguage/tst_qqmllanguage.cpp
+++ b/tests/auto/qml/qqmllanguage/tst_qqmllanguage.cpp
@@ -347,6 +347,7 @@ void tst_qqmllanguage::errors_data()
     QTest::newRow("nonexistantProperty.5") << "nonexistantProperty.5.qml" << "nonexistantProperty.5.errors.txt" << false;
     QTest::newRow("nonexistantProperty.6") << "nonexistantProperty.6.qml" << "nonexistantProperty.6.errors.txt" << false;
     QTest::newRow("nonexistantProperty.7") << "nonexistantProperty.7.qml" << "nonexistantProperty.7.errors.txt" << false;
+    QTest::newRow("nonexistantProperty.8") << "nonexistantProperty.8.qml" << "nonexistantProperty.8.errors.txt" << false;
 
     QTest::newRow("wrongType (string for int)") << "wrongType.1.qml" << "wrongType.1.errors.txt" << false;
     QTest::newRow("wrongType (int for bool)") << "wrongType.2.qml" << "wrongType.2.errors.txt" << false;