Fix crash when accessing var properties in objects with invalid context

We've had two indepedent reports of people running into the issue of
their QML code accidentally trying to access var properties in item view
delegates that were on the path of destruction, i.e. their QQmlContext was
already marked as invalid. Any such access would cause a failing assertion
in debug builds or a crash in release builds.

This patch removes the dependency to QQmlContextData for accessing the
var properties and adds a test-case that covers this use-case.

This is a regression from Qt 5.1.x.

Task-number: QTBUG-37227
Change-Id: Icf55d5fa8c15e45974e78086e9e11b2401ea9bad
Reviewed-by: Albert Astals Cid <albert.astals@canonical.com>
Reviewed-by: Lars Knoll <lars.knoll@digia.com>

2 files changed, 42 insertions, 0 deletions

diff --git a/tests/auto/qml/qqmlecmascript/data/varPropertyAccessOnObjectWithInvalidContext.qml b/tests/auto/qml/qqmlecmascript/data/varPropertyAccessOnObjectWithInvalidContext.qml
new file mode 100644
index 0000000000..d0d65a1e9a
--- /dev/null
+++ b/tests/auto/qml/qqmlecmascript/data/varPropertyAccessOnObjectWithInvalidContext.qml
@@ -0,0 +1,31 @@
+import QtQuick 2.0
+
+Item {
+    id: root
+    property bool success: false
+
+    ListModel {
+        id: theModel
+        ListElement {
+            name: "Apple"
+        }
+    }
+
+    property var firstDelegate;
+
+    Repeater {
+        id: repeater
+        model: theModel
+
+        delegate: Item {
+            property var myVarProperty: name;
+            Component.onCompleted: firstDelegate = this;
+        }
+    }
+
+    Component.onCompleted: {
+        repeater.model = null;
+        firstDelegate.myVarProperty = 42;
+        success = (firstDelegate.myVarProperty === 42);
+    }
+}
diff --git a/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp b/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp
index 60455c3acc..12ab4e5adc 100644
--- a/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp
+++ b/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp
@@ -318,6 +318,7 @@ private slots:
     void noCaptureWhenWritingProperty();
     void singletonWithEnum();
     void lazyBindingEvaluation();
+    void varPropertyAccessOnObjectWithInvalidContext();
 
 private:
 //    static void propertyVarWeakRefCallback(v8::Persistent<v8::Value> object, void* parameter);
@@ -7546,6 +7547,16 @@ void tst_qqmlecmascript::lazyBindingEvaluation()
    QCOMPARE(prop.toInt(), 2);
 }
 
+void tst_qqmlecmascript::varPropertyAccessOnObjectWithInvalidContext()
+{
+   QQmlComponent component(&engine, testFileUrl("varPropertyAccessOnObjectWithInvalidContext.qml"));
+   QScopedPointer<QObject> obj(component.create());
+   if (obj.isNull())
+       qDebug() << component.errors().first().toString();
+   QVERIFY(!obj.isNull());
+   QVERIFY(obj->property("success") == true);
+}
+
 QTEST_MAIN(tst_qqmlecmascript)
 
 #include "tst_qqmlecmascript.moc"