Engine: Fix handling of attached objects in function calls

When we use an attached object as an argument to a function call, we
need to properly extract it from the QmlTypeWrapper. Before this change,
we simpley left the argument pointer as null, which lead to subsequent
crashes when it got dereferenced.

Moreover, treat passing namespaces to functions expecting a QObject as a
TypeError, by returning false from CallArgument::fromValue (used to
crash for the same reason as with the attached object case).

Fixes: QTBUG-106119
Change-Id: Ifa6a32e20a29935aff1f265eb0edd3e35ea1c11b
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>
(cherry picked from commit 84483bff4f4d49e5f87abf564021647f2fb2a8d0)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>

1 files changed, 6 insertions, 4 deletions

diff --git a/src/qml/jsruntime/qv4qobjectwrapper.cpp b/src/qml/jsruntime/qv4qobjectwrapper.cpp
index 1a54102bf4..502b8bafa1 100644
--- a/src/qml/jsruntime/qv4qobjectwrapper.cpp
+++ b/src/qml/jsruntime/qv4qobjectwrapper.cpp
@@ -1958,14 +1958,16 @@ bool CallArgument::fromValue(
                 // Convert via QVariant below.
                 // TODO: Can't we just do qobjectPtr = qmlTypeWrapper->object() instead?
                 break;
+            } else if (QObject *obj = qmlTypeWrapper->object()) {
+                // attached object case
+                qobjectPtr = obj;
+                return true;
             }
 
             // If this is a plain type wrapper without an instance,
-            // then indeed it's an undefined parameter.
-            // (although we might interpret that as const QMetaObject *).
-            // TODO: But what if it's an attached object?
+            // then we got a namespace, and that's a type error
             type = QMetaType::UnknownType;
-            return true;
+            return false;
         }
 
         qobjectPtr = nullptr;