From 59b726e76a9c50d0f8c649da55039ee1ab18729f Mon Sep 17 00:00:00 2001
From: Shawn Rutledge <shawn.rutledge@qt.io>
Date: Wed, 16 Nov 2016 16:30:39 +0100
Subject: Don't crash: Connections with a signal on a nonexistent object
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Task-number: QTBUG-56551
Change-Id: Ide09f177d3f6a3e9902f8ea904b3e6e4b998bd39
Reviewed-by: Jan Arve Sæther <jan-arve.saether@qt.io>
(cherry picked from commit 02830aae1f3e9aaf89ca37637d40313babbff7b8)
Reviewed-by: Lars Knoll <lars.knoll@qt.io>
---
 src/qml/qml/qqmlpropertycache.cpp                             |  5 ++++-
 .../quick/qquickitem2/data/nonexistentPropertyConnection.qml  | 11 +++++++++++
 tests/auto/quick/qquickitem2/tst_qquickitem.cpp               | 10 ++++++++++
 3 files changed, 25 insertions(+), 1 deletion(-)
 create mode 100644 tests/auto/quick/qquickitem2/data/nonexistentPropertyConnection.qml

diff --git a/src/qml/qml/qqmlpropertycache.cpp b/src/qml/qml/qqmlpropertycache.cpp
index ff43e80649..782024eae9 100644
--- a/src/qml/qml/qqmlpropertycache.cpp
+++ b/src/qml/qml/qqmlpropertycache.cpp
@@ -1067,8 +1067,11 @@ int QQmlPropertyCache::originalClone(QObject *object, int index)
     QQmlData *data = QQmlData::get(object, false);
     if (data && data->propertyCache) {
         QQmlPropertyCache *cache = data->propertyCache;
-        while (cache->signal(index)->isCloned())
+        QQmlPropertyData *sig = cache->signal(index);
+        while (sig && sig->isCloned()) {
             --index;
+            sig = cache->signal(index);
+        }
     } else {
         while (QMetaObjectPrivate::signal(object->metaObject(), index).attributes() & QMetaMethod::Cloned)
             --index;
diff --git a/tests/auto/quick/qquickitem2/data/nonexistentPropertyConnection.qml b/tests/auto/quick/qquickitem2/data/nonexistentPropertyConnection.qml
new file mode 100644
index 0000000000..ed0632a68a
--- /dev/null
+++ b/tests/auto/quick/qquickitem2/data/nonexistentPropertyConnection.qml
@@ -0,0 +1,11 @@
+import QtQuick 2.4
+
+Item {
+    function hint() {
+    }
+
+    Connections {
+        target: BlaBlaBla
+        onHint: hint();
+    }
+}
diff --git a/tests/auto/quick/qquickitem2/tst_qquickitem.cpp b/tests/auto/quick/qquickitem2/tst_qquickitem.cpp
index 58dca5c1a3..4ba6d4cd4b 100644
--- a/tests/auto/quick/qquickitem2/tst_qquickitem.cpp
+++ b/tests/auto/quick/qquickitem2/tst_qquickitem.cpp
@@ -101,6 +101,7 @@ private slots:
     void mapCoordinatesRect();
     void mapCoordinatesRect_data();
     void propertyChanges();
+    void nonexistentPropertyConnection();
     void transforms();
     void transforms_data();
     void childrenRect();
@@ -2588,6 +2589,15 @@ void tst_QQuickItem::propertyChanges()
     delete window;
 }
 
+void tst_QQuickItem::nonexistentPropertyConnection()
+{
+    // QTBUG-56551: don't crash
+    QQmlComponent component(&engine, testFileUrl("nonexistentPropertyConnection.qml"));
+    QObject *o = component.create();
+    QVERIFY(o);
+    delete o;
+}
+
 void tst_QQuickItem::childrenRect()
 {
     QQuickView *window = new QQuickView(0);
-- 
cgit v1.2.3