From ea74f0c68cddf706c950d3910cf7b363fe24885b Mon Sep 17 00:00:00 2001
From: Ulf Hermann <ulf.hermann@qt.io>
Date: Wed, 17 Apr 2019 12:35:42 +0200
Subject: Don't crash when accessing invalid properties through QObjectWrapper

Change-Id: I613bf5dc685bb4235262b429d8f7318ea144fb9d
Fixes: QTBUG-75203
Reviewed-by: Erik Verbruggen <erik.verbruggen@qt.io>
---
 src/qml/jsruntime/qv4qobjectwrapper.cpp              |  2 +-
 .../data/undefinedPropertiesInObjectWrapper.qml      | 20 ++++++++++++++++++++
 tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp | 10 ++++++++++
 3 files changed, 31 insertions(+), 1 deletion(-)
 create mode 100644 tests/auto/qml/qqmlecmascript/data/undefinedPropertiesInObjectWrapper.qml

diff --git a/src/qml/jsruntime/qv4qobjectwrapper.cpp b/src/qml/jsruntime/qv4qobjectwrapper.cpp
index 377c30617a..5467e730e3 100644
--- a/src/qml/jsruntime/qv4qobjectwrapper.cpp
+++ b/src/qml/jsruntime/qv4qobjectwrapper.cpp
@@ -856,7 +856,7 @@ ReturnedValue QObjectWrapper::virtualResolveLookupGetter(const Object *object, E
     if (!ddata || !ddata->propertyCache) {
         QQmlPropertyData local;
         QQmlPropertyData *property = QQmlPropertyCache::property(engine->jsEngine(), qobj, name, qmlContext, local);
-        return getProperty(engine, qobj, property);
+        return property ? getProperty(engine, qobj, property) : QV4::Encode::undefined();
     }
     QQmlPropertyData *property = ddata->propertyCache->property(name.getPointer(), qobj, qmlContext);
 
diff --git a/tests/auto/qml/qqmlecmascript/data/undefinedPropertiesInObjectWrapper.qml b/tests/auto/qml/qqmlecmascript/data/undefinedPropertiesInObjectWrapper.qml
new file mode 100644
index 0000000000..7e2f15fc23
--- /dev/null
+++ b/tests/auto/qml/qqmlecmascript/data/undefinedPropertiesInObjectWrapper.qml
@@ -0,0 +1,20 @@
+import QtQuick 2.12
+
+QtObject {
+    property list<QtObject> entries: [
+        QtObject {
+            readonly property color color: "green"
+        },
+        QtObject {
+        }
+    ]
+
+    property Row row: Row {
+        Repeater {
+            model: entries
+            Rectangle {
+                color: model.color ? model.color : "red"
+            }
+        }
+    }
+}
diff --git a/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp b/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp
index 0e8844d23f..85cad8f62c 100644
--- a/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp
+++ b/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp
@@ -367,6 +367,7 @@ private slots:
     void deleteSparseInIteration();
     void saveAccumulatorBeforeToInt32();
     void intMinDividedByMinusOne();
+    void undefinedPropertiesInObjectWrapper();
 
 private:
 //    static void propertyVarWeakRefCallback(v8::Persistent<v8::Value> object, void* parameter);
@@ -8958,6 +8959,15 @@ void tst_qqmlecmascript::intMinDividedByMinusOne()
     QCOMPARE(object->property("doesNotFitInInt").toUInt(), 2147483648u);
 }
 
+void tst_qqmlecmascript::undefinedPropertiesInObjectWrapper()
+{
+    QQmlEngine engine;
+    QQmlComponent component(&engine, testFile("undefinedPropertiesInObjectWrapper.qml"));
+    QVERIFY(component.isReady());
+    QScopedPointer<QObject> object(component.create());
+    QVERIFY(!object.isNull());
+}
+
 QTEST_MAIN(tst_qqmlecmascript)
 
 #include "tst_qqmlecmascript.moc"
-- 
cgit v1.2.3