QXmlSchema internals: fix crash with anonymous types

The crash occurred when an anonymous type was created that was a list
type. In that case, we did not set the item type, which is used later at
XsdSchemaChecker::checkSimpleDerivationRestrictions(), which would lead
to a crash.

Additionally, in the xmlpatternsvalidator test, check the exit status of
the process after it has finished, to detect crashes.

Reviewed-by: Tobias Koenig <tokoe@kde.org>
Reviewed-by: Frans Englich
Task-number: QTBUG-8920

3 files changed, 41 insertions, 5 deletions

diff --git a/src/xmlpatterns/schema/qxsdschemaresolver.cpp b/src/xmlpatterns/schema/qxsdschemaresolver.cpp
index 34eb12c..f3d1ed0 100644
--- a/src/xmlpatterns/schema/qxsdschemaresolver.cpp
+++ b/src/xmlpatterns/schema/qxsdschemaresolver.cpp
@@ -632,7 +632,14 @@ void XsdSchemaResolver::resolveSimpleContentComplexTypes(const XsdComplexType::P
                 } else {
                     // 1.2
                     const XsdSimpleType::Ptr anonType(new XsdSimpleType());
-                    anonType->setCategory(complexBaseType->contentType()->simpleType()->category());
+                    XsdSimpleType::TypeCategory baseCategory = complexBaseType->contentType()->simpleType()->category();
+                    anonType->setCategory(baseCategory);
+
+                    if (baseCategory == XsdSimpleType::SimpleTypeList) {
+                        const XsdSimpleType::Ptr baseSimpleType = complexBaseType->contentType()->simpleType();
+                        anonType->setItemType(baseSimpleType->itemType());
+                    }
+
                     anonType->setDerivationMethod(XsdSimpleType::DerivationRestriction);
                     anonType->setWxsSuperType(complexBaseType->contentType()->simpleType());
                     anonType->setFacets(complexTypeFacets(complexType));
diff --git a/tests/auto/xmlpatternsvalidator/files/complex-type-including-anonymous-type.xsd b/tests/auto/xmlpatternsvalidator/files/complex-type-including-anonymous-type.xsd
new file mode 100644
index 0000000..da765b4
--- /dev/null
+++ b/tests/auto/xmlpatternsvalidator/files/complex-type-including-anonymous-type.xsd
@@ -0,0 +1,24 @@
+<schema targetNamespace="http://qt.nokia.com/test"
+        xmlns:gml="http://qt.nokia.com/test"
+        xmlns="http://www.w3.org/2001/XMLSchema">
+
+    <!-- ============= This is an excerpt from GML (http://www.opengis.net/gml)
+                       which used to produce a crash in QXmlSchema ========== -->
+
+    <simpleType name="doubleList">
+        <list itemType="double"/>
+    </simpleType>
+
+    <complexType name="DirectPositionType">
+        <simpleContent>
+            <extension base="gml:doubleList"/>
+        </simpleContent>
+    </complexType>
+
+    <complexType name="VectorType">
+        <simpleContent>
+            <restriction base="gml:DirectPositionType"/>
+        </simpleContent>
+    </complexType>
+
+</schema>
diff --git a/tests/auto/xmlpatternsvalidator/tst_xmlpatternsvalidator.cpp b/tests/auto/xmlpatternsvalidator/tst_xmlpatternsvalidator.cpp
index 7aab47f..3517b5a 100644
--- a/tests/auto/xmlpatternsvalidator/tst_xmlpatternsvalidator.cpp
+++ b/tests/auto/xmlpatternsvalidator/tst_xmlpatternsvalidator.cpp
@@ -111,8 +111,8 @@ void tst_XmlPatternsValidator::xsdSupport()
 
     process.start(m_command, arguments);
 
-    QCOMPARE(process.exitStatus(), QProcess::NormalExit);
     QVERIFY(process.waitForFinished());
+    QCOMPARE(process.exitStatus(), QProcess::NormalExit);
 
     if(process.exitCode() != expectedExitCode)
         QTextStream(stderr) << "foo:" << process.readAllStandardError();
@@ -197,20 +197,25 @@ void tst_XmlPatternsValidator::xsdSupport_data() const
         << (QStringList() << QLatin1String("files/instance.xml"))
         << QString();
 
-    QTest::newRow("A schema with an indirectly included type")
+    QTest::newRow("QTBUG-8394 A schema with an indirectly included type")
         << 0
         << (QStringList() << QLatin1String("files/indirect-include-a.xsd"))
         << QString();
 
-    QTest::newRow("A schema with an indirectly imported type")
+    QTest::newRow("QTBUG-8394 A schema with an indirectly imported type")
         << 0
         << (QStringList() << QLatin1String("files/indirect-import-a.xsd"))
         << QString();
 
-    QTest::newRow("A schema with an indirectly redefined type")
+    QTest::newRow("QTBUG-8394 A schema with an indirectly redefined type")
         << 0
         << (QStringList() << QLatin1String("files/indirect-redefine-a.xsd"))
         << QString();
+
+    QTest::newRow("QTBUG-8920 A schema with a complex type that indirectly includes an anonymous type")
+        << 0
+        << (QStringList() << QLatin1String("files/complex-type-including-anonymous-type.xsd"))
+        << QString();
 }
 
 QTEST_MAIN(tst_XmlPatternsValidator)