Don't crash on invalid expressions

QTBUG-5577

3 files changed, 14 insertions, 3 deletions

diff --git a/src/declarative/qml/qmlexpression.cpp b/src/declarative/qml/qmlexpression.cpp
index 4e4daf7..d2d60ee 100644
--- a/src/declarative/qml/qmlexpression.cpp
+++ b/src/declarative/qml/qmlexpression.cpp
@@ -315,7 +315,12 @@ QVariant QmlExpressionPrivate::evalQtScript(QObject *secondaryScope, bool *isUnd
         } else {
             QmlRewrite::RewriteBinding rewriteBinding;
 
-            const QString code = rewriteBinding(data->expression);
+            bool ok = true;
+            const QString code = rewriteBinding(data->expression, &ok);
+            if (!ok) {
+                scriptEngine->popContext();
+                return QVariant();
+            }
             data->expressionFunction = scriptEngine->evaluate(code, data->url.toString(), data->line);
         }
 
diff --git a/src/declarative/qml/qmlrewrite.cpp b/src/declarative/qml/qmlrewrite.cpp
index b86f2f2..32e2fef 100644
--- a/src/declarative/qml/qmlrewrite.cpp
+++ b/src/declarative/qml/qmlrewrite.cpp
@@ -49,7 +49,7 @@ DEFINE_BOOL_CONFIG_OPTION(rewriteDump, QML_REWRITE_DUMP);
 
 namespace QmlRewrite {
 
-QString RewriteBinding::operator()(const QString &code)
+QString RewriteBinding::operator()(const QString &code, bool *ok)
 {
     Engine engine;
     NodePool pool(QString(), &engine);
@@ -57,6 +57,12 @@ QString RewriteBinding::operator()(const QString &code)
     Parser parser(&engine);
     lexer.setCode(code, 0);
     parser.parseStatement();
+    if (!parser.statement()) {
+        if (ok) *ok = false;
+        return QString();
+    } else {
+        if (ok) *ok = true;
+    }
     return rewrite(code, 0, parser.statement());
 }
 
diff --git a/src/declarative/qml/qmlrewrite_p.h b/src/declarative/qml/qmlrewrite_p.h
index 914f997..a5cb841 100644
--- a/src/declarative/qml/qmlrewrite_p.h
+++ b/src/declarative/qml/qmlrewrite_p.h
@@ -69,7 +69,7 @@ class RewriteBinding: protected AST::Visitor
     TextWriter *_writer;
 
 public:
-    QString operator()(const QString &code);
+    QString operator()(const QString &code, bool *ok = 0);
 
 protected:
     using AST::Visitor::visit;