Loading...

XML

Word

Printable

Details

Type: Bug
Resolution: Fixed
Priority: P1: Critical
Fix Version/s: 6.5, 6.6.1, 6.7.0 FF
Affects Version/s: 6.6.0
Component/s: QML: Declarative and Javascript Engine
Labels:
None

Commits:
ba6ddfab5 (dev), b76cb7cb6 (6.6)

Description

QQmlScriptString::operator==(const QQmlScriptString &) crashes if other is invalid, i.e. has a null d-pointer. It has a guard against its own d being null, but not against the other.d being null:

bool QQmlScriptString::operator==(const QQmlScriptString &other) const
{
    if (d == other.d)
        return true;
    if (!d)
        return false;

    // boom if other.d == nullptr
    if (d->isNumberLiteral || other.d->isNumberLiteral)
        return d->isNumberLiteral && other.d->isNumberLiteral && d->numberValue == other.d->numberValue;

    ...