don't crash in property access after script class has been set to 0

When the script class is set to 0, we need to remove the script
object's delegate entirely, because the delegate requires a non-0
script class in order to be useful.

Reviewed-by: Olivier Goffart

2 files changed, 10 insertions, 5 deletions

diff --git a/src/script/api/qscriptvalue.cpp b/src/script/api/qscriptvalue.cpp
index 6a6381e..2a33aea 100644
--- a/src/script/api/qscriptvalue.cpp
+++ b/src/script/api/qscriptvalue.cpp
@@ -2409,12 +2409,16 @@ void QScriptValue::setScriptClass(QScriptClass *scriptClass)
         return;
     }
     QScriptObject *scriptObject = static_cast<QScriptObject*>(JSC::asObject(d->jscValue));
-    QScriptObjectDelegate *delegate = scriptObject->delegate();
-    if (!delegate || (delegate->type() != QScriptObjectDelegate::ClassObject)) {
-        delegate = new QScript::ClassObjectDelegate(scriptClass);
-        scriptObject->setDelegate(delegate);
+    if (!scriptClass) {
+        scriptObject->setDelegate(0);
+    } else {
+        QScriptObjectDelegate *delegate = scriptObject->delegate();
+        if (!delegate || (delegate->type() != QScriptObjectDelegate::ClassObject)) {
+            delegate = new QScript::ClassObjectDelegate(scriptClass);
+            scriptObject->setDelegate(delegate);
+        }
+        static_cast<QScript::ClassObjectDelegate*>(delegate)->setScriptClass(scriptClass);
     }
-    static_cast<QScript::ClassObjectDelegate*>(delegate)->setScriptClass(scriptClass);
 }
 
 /*!
diff --git a/src/script/bridge/qscriptclassobject.cpp b/src/script/bridge/qscriptclassobject.cpp
index b57909f..c1e386b 100644
--- a/src/script/bridge/qscriptclassobject.cpp
+++ b/src/script/bridge/qscriptclassobject.cpp
@@ -77,6 +77,7 @@ QScriptClass *ClassObjectDelegate::scriptClass() const
 
 void ClassObjectDelegate::setScriptClass(QScriptClass *scriptClass)
 {
+    Q_ASSERT(scriptClass != 0);
     m_scriptClass = scriptClass;
 }