Fix a crash in QQmlPropertyCache::findProperty

Fix a crash in QQmlPropertyCache::findProperty

When the top type of a QML component is a C++ type registered with
qmlRegisterExtendedType, its QObjectPrivate::metaObject is already a
QQmlProxyMetaObject that gets chained as the parent of the
QQmlVMEMetaObject of the component.

When QQmlPropertyCache::findProperty iterates over the parents chain
of a child item, our QQmlProxyMetaObject eventually gets static_casted
to QQmlVMEMetaObject and causes a crash.

This patch implements a poor man's dynamic_cast in
QQmlVMEMetaObject::parentVMEMetaObject to fix the crash. Other casts
of parent.asT1() are changed to use parentVMEMetaObject as well even
though in those cases the static_cast is guaranteed by the context.

Task-number: QTBUG-27334
Change-Id: I5982fc273ccf466960ce54974cff5662e6ab605a
Reviewed-by: Matthew Vogt <mattvogt2@gmail.com>
Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>