qmllint: Fix null deref in quick plugin

In certain degenerate cases (e.g. missing imports), we might end up with
a composite type which does not have a base type.
That so far caused a crash in the binding check. To fix this, simply
detect the situation, and skip the warning – we will already warn about
the unknown type anyway.

Fixes: QTBUG-106562
Change-Id: Iff7e202cf5bd6b5c8d7cb90a46fb2573cb74ecaa
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>
(cherry picked from commit 8bf24e93ba)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>

src/plugins/qmllint/quick/quicklintplugin.cpp

@@ -482,8 +482,19 @@ void VarBindingTypeValidatorPass::onBinding(const QQmlSA::Element &element,
                      [&](const QQmlSA::Element &scope) { return bindingType->inherits(scope); })
         == range.second) {
 
+        const bool bindingTypeIsComposite = bindingType->isComposite();
+        if (bindingTypeIsComposite && !bindingType->baseType()) {
+            /* broken module or missing import, there is nothing we
+               can really check here, as something is amiss. We
+               simply skip this binding, and assume that whatever
+               caused the breakage here will already cause another
+               warning somewhere else.
+             */
+            return;
+        }
         const QString bindingTypeName = QQmlJSScope::prettyName(
-                bindingType->isComposite() ? bindingType->baseType()->internalName()
+                    bindingTypeIsComposite
+                    ? bindingType->baseType()->internalName()
                     : bindingType->internalName());
         QStringList expectedTypeNames;
 

tests/auto/qml/qmllint/data/pluginQuick_noCrashOnUneresolved.qml

@@ -0,0 +1,10 @@
+import QtQuick.Controls
+
+Item {
+
+    Tumbler {
+
+        contentItem: Item {
+        }
+    }
+}

tests/auto/qml/qmllint/tst_qmllint.cpp

@@ -1897,6 +1897,7 @@ void TestQmllint::quickPlugin()
     runTest("pluginQuick_varPropClean.qml", Result::clean());
     runTest("pluginQuick_attachedClean.qml", Result::clean());
     runTest("pluginQuick_attachedIgnore.qml", Result::clean());
+    runTest("pluginQuick_noCrashOnUneresolved.qml", Result {}); // we don't care about the specific warnings
 }
 #endif