QVariant::operator == may crash if the compared object is of user type.

The easiest way to reproduce this is evaluating QVariant(QVariant::UserType) == QVariant(QVariant::UserType)

The crash happens in qvariant.cpp line 470

    const char *const typeName = QMetaType::typeName(a->type);
    if (typeName[qstrlen(typeName) - 1] == '*')
        return *static_cast<void **>(a->data.shared->ptr) ==
               *static_cast<void **>(b->data.shared->ptr);

The typeName can be NULL, in which case crash occurs.

We used QVariant::UserType to create a "valid" QVariant to denote the null value of json. This might or might not be a good way to represent null value. Anyway, QVariant does not have a null type, it has invalid type and null values for other types.