Avoid rare crash

In the case where a QML type had been registered with the same
metaobject, you could dereference the c++ type union data when it hadn't
been allocated.

Change-Id: I906d68710cf88b379933eb13cf0668738f07d5f4
Reviewed-by: Matthew Vogt <matthew.vogt@qinetic.com.au>

1 files changed, 12 insertions, 10 deletions

diff --git a/src/qml/qml/qqmlmetatype.cpp b/src/qml/qml/qqmlmetatype.cpp
index 372475d85c..0f3a27aeff 100644
--- a/src/qml/qml/qqmlmetatype.cpp
+++ b/src/qml/qml/qqmlmetatype.cpp
@@ -582,16 +582,18 @@ void QQmlTypePrivate::init() const
     while(mo) {
         QQmlType *t = metaTypeData()->metaObjectToType.value(mo);
         if (t) {
-            if (t->d->extraData.cd->extFunc) {
-                QMetaObjectBuilder builder;
-                clone(builder, t->d->extraData.cd->extMetaObject, t->d->baseMetaObject, baseMetaObject);
-                builder.setFlags(QMetaObjectBuilder::DynamicMetaObject);
-                QMetaObject *mmo = builder.toMetaObject();
-                mmo->d.superdata = baseMetaObject;
-                if (!metaObjects.isEmpty())
-                    metaObjects.last().metaObject->d.superdata = mmo;
-                QQmlProxyMetaObject::ProxyData data = { mmo, t->d->extraData.cd->extFunc, 0, 0 };
-                metaObjects << data;
+            if (t->d->regType == QQmlType::CppType) {
+                if (t->d->extraData.cd->extFunc) {
+                    QMetaObjectBuilder builder;
+                    clone(builder, t->d->extraData.cd->extMetaObject, t->d->baseMetaObject, baseMetaObject);
+                    builder.setFlags(QMetaObjectBuilder::DynamicMetaObject);
+                    QMetaObject *mmo = builder.toMetaObject();
+                    mmo->d.superdata = baseMetaObject;
+                    if (!metaObjects.isEmpty())
+                        metaObjects.last().metaObject->d.superdata = mmo;
+                    QQmlProxyMetaObject::ProxyData data = { mmo, t->d->extraData.cd->extFunc, 0, 0 };
+                    metaObjects << data;
+                }
             }
         }
         mo = mo->d.superdata;