aboutsummaryrefslogtreecommitdiffstats
path: root/src/qml/qml/qqmlobjectcreator.cpp
diff options
context:
space:
mode:
authorEvgeniy A. Dushistov <dushistov@mail.ru>2020-08-20 00:33:18 +0300
committerUlf Hermann <ulf.hermann@qt.io>2020-08-22 18:53:37 +0200
commitb953bd67d4134b9af3e554a0287a462ddf2de5f7 (patch)
tree81e6b545c8e5a813fa643e8824073ff4e4396f6b /src/qml/qml/qqmlobjectcreator.cpp
parent3aa4cd682f52b70803cc3f72d732bde9987677dd (diff)
QQmlObjectCreator: fix member func call with this == nullptr
The test example is based on qtvirtualkeyboard/src/virtualkeyboard/content/components/PopupList.qml Luckily ((QQmlPropertyCache *)nullptr) -> property(-1) is ended without access to this, so this was not caught before. But this is UB, plus I can not run Qt and my application compiled with -fsanitizer=X, because of it crashed after the first member function call with nullptr as this Fixes: QTBUG-85605 Change-Id: If6a71fde9a14cc4f73139dfa0e6ee3005453104d Reviewed-by: Ulf Hermann <ulf.hermann@qt.io> Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>
Diffstat (limited to 'src/qml/qml/qqmlobjectcreator.cpp')
-rw-r--r--src/qml/qml/qqmlobjectcreator.cpp2
1 files changed, 1 insertions, 1 deletions
diff --git a/src/qml/qml/qqmlobjectcreator.cpp b/src/qml/qml/qqmlobjectcreator.cpp
index 1142618e2d..5fa0eb281e 100644
--- a/src/qml/qml/qqmlobjectcreator.cpp
+++ b/src/qml/qml/qqmlobjectcreator.cpp
@@ -1589,7 +1589,7 @@ bool QQmlObjectCreator::populateInstance(int index, QObject *instance, QObject *
if (!target)
continue;
QQmlData *targetDData = QQmlData::get(target, /*create*/false);
- if (!targetDData)
+ if (targetDData == nullptr || targetDData->propertyCache == nullptr)
continue;
int coreIndex = QQmlPropertyIndex::fromEncoded(alias->encodedMetaPropertyIndex).coreIndex();
QQmlPropertyData *const targetProperty = targetDData->propertyCache->property(coreIndex);