[new compiler] Fix crash in tst_qquickpathview

QQuickPathView's attached object uses a dynamic meta-object. So when installing
bindings - such as a signal handler - on it and we want to determine the
property cache for it, we must not use the QQmlEnginePrivate::cache overload
that takes a QObject pointer, as that will - rightly so - return a null
pointer. Instead in this case it is okay to go with the static type overload,
by using the meta-object of the attached type known at compile time.  This is
consistent with the VME code path.

Change-Id: Iffc64f7ee4677c6cc60d071b80f4032cf8037ab7
Reviewed-by: Lars Knoll <lars.knoll@digia.com>

1 files changed, 3 insertions, 1 deletions

diff --git a/src/qml/qml/qqmlobjectcreator.cpp b/src/qml/qml/qqmlobjectcreator.cpp
index 0df52edb08..ac438b2b7c 100644
--- a/src/qml/qml/qqmlobjectcreator.cpp
+++ b/src/qml/qml/qqmlobjectcreator.cpp
@@ -737,7 +737,8 @@ bool QQmlObjectCreator::setPropertyBinding(QQmlPropertyData *property, const QV4
         QQmlType *attachedType = tr->type;
         const int id = attachedType->attachedPropertiesId();
         QObject *qmlObject = qmlAttachedPropertiesObjectById(id, _qobject);
-        QQmlRefPointer<QQmlPropertyCache> cache = QQmlEnginePrivate::get(engine)->cache(qmlObject);
+        QQmlRefPointer<QQmlPropertyCache> cache = QQmlEnginePrivate::get(engine)->cache(attachedType->attachedPropertiesType());
+        Q_ASSERT(!cache.isNull());
         if (!populateInstance(binding->value.objectIndex, qmlObject, cache, qmlObject, /*value type property*/0))
             return false;
         return true;
@@ -1288,6 +1289,7 @@ bool QQmlObjectCreator::populateInstance(int index, QObject *instance, QQmlRefPo
         vmeMetaObject = QQmlVMEMetaObject::get(_qobject);
     }
     if (installPropertyCache) {
+        Q_ASSERT(_propertyCache);
         _ddata->propertyCache = _propertyCache;
         _ddata->propertyCache->addref();
     }