Engine: Fix handling of attached objects in function calls

When we use an attached object as an argument to a function call, we
need to properly extract it from the QmlTypeWrapper. Before this change,
we simpley left the argument pointer as null, which lead to subsequent
crashes when it got dereferenced.

Moreover, treat passing namespaces to functions expecting a QObject as a
TypeError, by returning false from CallArgument::fromValue (used to
crash for the same reason as with the attached object case).

Fixes: QTBUG-106119
Change-Id: Ifa6a32e20a29935aff1f265eb0edd3e35ea1c11b
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>
(cherry picked from commit 84483bff4f4d49e5f87abf564021647f2fb2a8d0)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>

1 files changed, 6 insertions, 4 deletions

diff --git a/src/qml/jsruntime/qv4qobjectwrapper.cpp b/src/qml/jsruntime/qv4qobjectwrapper.cpp
index d5e6c1b84a..b45d8cd315 100644
--- a/src/qml/jsruntime/qv4qobjectwrapper.cpp
+++ b/src/qml/jsruntime/qv4qobjectwrapper.cpp
@@ -1903,14 +1903,16 @@ bool CallArgument::fromValue(QMetaType metaType, ExecutionEngine *engine, const
                 // Convert via QVariant below.
                 // TODO: Can't we just do qobjectPtr = qmlTypeWrapper->object() instead?
                 break;
+            } else if (QObject *obj = qmlTypeWrapper->object()) {
+                // attached object case
+                qobjectPtr = obj;
+                return true;
             }
 
             // If this is a plain type wrapper without an instance,
-            // then indeed it's an undefined parameter.
-            // (although we might interpret that as const QMetaObject *).
-            // TODO: But what if it's an attached object?
+            // then we got a namespace, and that's a type error
             type = QMetaType::UnknownType;
-            return true;
+            return false;
         }
 
         qobjectPtr = nullptr;