Item.mapFromItem() crashes with Items not created by the engine.

Item.mapFromItem() and Item.mapToItem() get the script engine from
the item they are called on.  Safer to use the script value passed
to the function to determine the engine being used.

Task-number: QTBUG-26280
Change-Id: Id9d6c952cc91c7799910b29a27e24945d8ba073b
Reviewed-by: Andrew den Exter <andrew.den-exter@nokia.com>

1 files changed, 4 insertions, 2 deletions

diff --git a/src/declarative/graphicsitems/qdeclarativeitem.cpp b/src/declarative/graphicsitems/qdeclarativeitem.cpp
index 46070ea..7d05d53 100644
--- a/src/declarative/graphicsitems/qdeclarativeitem.cpp
+++ b/src/declarative/graphicsitems/qdeclarativeitem.cpp
@@ -2617,13 +2617,14 @@ void QDeclarativeItem::setKeepMouseGrab(bool keep)
 */
 QScriptValue QDeclarativeItem::mapFromItem(const QScriptValue &item, qreal x, qreal y) const
 {
-    QScriptValue sv = QDeclarativeEnginePrivate::getScriptEngine(qmlEngine(this))->newObject();
     QDeclarativeItem *itemObj = qobject_cast<QDeclarativeItem*>(item.toQObject());
     if (!itemObj && !item.isNull()) {
         qmlInfo(this) << "mapFromItem() given argument \"" << item.toString() << "\" which is neither null nor an Item";
         return 0;
     }
 
+    QScriptValue sv = item.engine()->newObject();
+
     // If QGraphicsItem::mapFromItem() is called with 0, behaves the same as mapFromScene()
     QPointF p = qobject_cast<QGraphicsItem*>(this)->mapFromItem(itemObj, x, y);
     sv.setProperty(QLatin1String("x"), p.x());
@@ -2654,13 +2655,14 @@ QScriptValue QDeclarativeItem::mapFromItem(const QScriptValue &item, qreal x, qr
 */
 QScriptValue QDeclarativeItem::mapToItem(const QScriptValue &item, qreal x, qreal y) const
 {
-    QScriptValue sv = QDeclarativeEnginePrivate::getScriptEngine(qmlEngine(this))->newObject();
     QDeclarativeItem *itemObj = qobject_cast<QDeclarativeItem*>(item.toQObject());
     if (!itemObj && !item.isNull()) {
         qmlInfo(this) << "mapToItem() given argument \"" << item.toString() << "\" which is neither null nor an Item";
         return 0;
     }
 
+    QScriptValue sv = item.engine()->newObject();
+
     // If QGraphicsItem::mapToItem() is called with 0, behaves the same as mapToScene()
     QPointF p = qobject_cast<QGraphicsItem*>(this)->mapToItem(itemObj, x, y);
     sv.setProperty(QLatin1String("x"), p.x());