Fix crash on null object assignment

3 files changed, 25 insertions, 1 deletions

diff --git a/src/declarative/qml/qdeclarativebinding.cpp b/src/declarative/qml/qdeclarativebinding.cpp
index 9a7a242..b397177 100644
--- a/src/declarative/qml/qdeclarativebinding.cpp
+++ b/src/declarative/qml/qdeclarativebinding.cpp
@@ -164,7 +164,8 @@ void QDeclarativeBinding::update(QDeclarativePropertyPrivate::WriteFlags flags)
                     // 100% reliable, in many cases it gives us better error messages if we
                     // assign this null-object to an incompatible property
                     int type = ep->objectClass->objectType(scriptValue);
-                    value = QVariant(type, (void *)0);
+                    QObject *o = 0;
+                    value = QVariant(type, (void *)&o);
                 }
             }
 
diff --git a/tests/auto/declarative/qdeclarativeecmascript/data/nullObjectBinding.qml b/tests/auto/declarative/qdeclarativeecmascript/data/nullObjectBinding.qml
new file mode 100644
index 0000000..1bf0b81
--- /dev/null
+++ b/tests/auto/declarative/qdeclarativeecmascript/data/nullObjectBinding.qml
@@ -0,0 +1,8 @@
+import Qt 4.6
+
+QtObject {
+    property QtObject test
+    test: if (1) model
+    property ListModel model
+}
+
diff --git a/tests/auto/declarative/qdeclarativeecmascript/tst_qdeclarativeecmascript.cpp b/tests/auto/declarative/qdeclarativeecmascript/tst_qdeclarativeecmascript.cpp
index 0e2b497..f675801 100644
--- a/tests/auto/declarative/qdeclarativeecmascript/tst_qdeclarativeecmascript.cpp
+++ b/tests/auto/declarative/qdeclarativeecmascript/tst_qdeclarativeecmascript.cpp
@@ -137,6 +137,7 @@ private slots:
     void bug1();
     void dynamicCreationCrash();
     void regExpBug();
+    void nullObjectBinding();
 
     void callQtInvokables();
 private:
@@ -2143,6 +2144,20 @@ void tst_qdeclarativeecmascript::numberAssignment()
     delete object;
 }
 
+// Test that assigning a null object works 
+// Regressed with: df1788b4dbbb2826ae63f26bdf166342595343f4
+void tst_qdeclarativeecmascript::nullObjectBinding()
+{
+    QDeclarativeComponent component(&engine, TEST_FILE("nullObjectBinding.qml"));
+
+    QObject *object = component.create();
+    QVERIFY(object != 0);
+
+    QVERIFY(object->property("test") == QVariant::fromValue((QObject *)0));
+
+    delete object;
+}
+
 QTEST_MAIN(tst_qdeclarativeecmascript)
 
 #include "tst_qdeclarativeecmascript.moc"