QmlCompile: Double-check types before generating lookups

In case of incomplete type information, we can get QJSValue as output
type where we expect QObject*. We cannot generate any sensible code for
that.

Change-Id: If817de7dca3b5b0b58aff92dec2dd12a7c10d250
Pick-to: 6.2 6.3
Fixes: QTBUG-102554
Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>

src/qmlcompiler/qqmljscodegenerator.cpp

@@ -740,6 +740,7 @@ void QQmlJSCodeGenerator::generateTypeLookup(int index)
 
     switch (m_state.accumulatorOut().variant()) {
     case QQmlJSRegisterContent::Singleton: {
+        rejectIfNonQObjectOut(u"non-QObject singleton type"_qs);
         const QString lookup = u"aotContext->loadSingletonLookup("_qs + indexString
                 + u", &"_qs + m_state.accumulatorVariableOut + u')';
         const QString initialization = u"aotContext->initLoadSingletonLookup("_qs + indexString
@@ -750,6 +751,7 @@ void QQmlJSCodeGenerator::generateTypeLookup(int index)
     case QQmlJSRegisterContent::ScopeModulePrefix:
         break;
     case QQmlJSRegisterContent::ScopeAttached: {
+        rejectIfNonQObjectOut(u"non-QObject attached type"_qs);
         const QString lookup = u"aotContext->loadAttachedLookup("_qs + indexString
                 + u", aotContext->qmlScopeObject, &"_qs + m_state.accumulatorVariableOut + u')';
         const QString initialization = u"aotContext->initLoadAttachedLookup("_qs + indexString
@@ -761,6 +763,12 @@ void QQmlJSCodeGenerator::generateTypeLookup(int index)
         reject(u"script lookup"_qs);
         break;
     case QQmlJSRegisterContent::MetaType: {
+        if (!m_typeResolver->registerIsStoredIn(
+                    m_state.accumulatorOut(), m_typeResolver->metaObjectType())) {
+            // TODO: Can we trigger this somehow?
+            //       It might be impossible, but we better be safe here.
+            reject(u"meta-object stored in different type"_qs);
+        }
         const QString lookup = u"aotContext->loadTypeLookup("_qs + indexString
                 + u", &"_qs + m_state.accumulatorVariableOut + u')';
         const QString initialization = u"aotContext->initLoadTypeLookup("_qs + indexString
@@ -793,6 +801,14 @@ void QQmlJSCodeGenerator::generateOutputVariantConversion(const QQmlJSScope::Con
     m_body += changedRegisterVariable() + u".convert("_qs + metaTypeFromName(target) + u");\n"_qs;
 }
 
+void QQmlJSCodeGenerator::rejectIfNonQObjectOut(const QString &error)
+{
+    if (m_state.accumulatorOut().storedType()->accessSemantics()
+        != QQmlJSScope::AccessSemantics::Reference) {
+        reject(error);
+    }
+}
+
 void QQmlJSCodeGenerator::generate_GetLookup(int index)
 {
     INJECT_TRACE_INFO(generate_GetLookup);
@@ -830,15 +846,6 @@ void QQmlJSCodeGenerator::generate_GetLookup(int index)
                                   == QQmlJSScope::AccessSemantics::Reference);
 
     switch (m_state.accumulatorOut().variant()) {
-    case QQmlJSRegisterContent::ScopeAttached: {
-        const QString lookup = u"aotContext->loadAttachedLookup("_qs + indexString
-                + u", aotContext->qmlScopeObject, &"_qs + m_state.accumulatorVariableOut + u')';
-        const QString initialization = u"aotContext->initLoadAttachedLookup("_qs
-                + indexString + u", "_qs + namespaceString
-                + u", aotContext->qmlScopeObject)"_qs;
-        generateLookup(lookup, initialization);
-        return;
-    }
     case QQmlJSRegisterContent::ObjectAttached: {
         if (!isReferenceType) {
             // This can happen on incomplete type information. We contextually know that the
@@ -847,6 +854,7 @@ void QQmlJSCodeGenerator::generate_GetLookup(int index)
             // that would be expensive.
             reject(u"attached object for non-QObject type"_qs);
         }
+        rejectIfNonQObjectOut(u"non-QObject attached type"_qs);
 
         const QString lookup = u"aotContext->loadAttachedLookup("_qs + indexString
                 + u", "_qs + m_state.accumulatorVariableIn
@@ -857,20 +865,10 @@ void QQmlJSCodeGenerator::generate_GetLookup(int index)
         generateLookup(lookup, initialization);
         return;
     }
-    case QQmlJSRegisterContent::Singleton: {
-        const QString lookup = u"aotContext->loadSingletonLookup("_qs + indexString
-                + u", &"_qs + m_state.accumulatorVariableOut + u')';
-        const QString initialization = u"aotContext->initLoadSingletonLookup("_qs
-                + indexString + u", "_qs + namespaceString + u')';
-        generateLookup(lookup, initialization);
-        return;
-    }
+    case QQmlJSRegisterContent::ScopeAttached:
+    case QQmlJSRegisterContent::Singleton:
     case QQmlJSRegisterContent::MetaType: {
-        const QString lookup = u"aotContext->loadTypeLookup("_qs + indexString
-                + u", &"_qs + m_state.accumulatorVariableOut + u')';
-        const QString initialization = u"aotContext->initLoadTypeLookup("_qs + indexString
-                + u", "_qs + namespaceString + u")"_qs;
-        generateLookup(lookup, initialization);
+        generateTypeLookup(index);
         return;
     }
     default:

src/qmlcompiler/qqmljscodegenerator_p.h

@@ -280,6 +280,7 @@ private:
     void generateMoveOutVar(const QString &outVar);
     void generateTypeLookup(int index);
     void generateOutputVariantConversion(const QQmlJSScope::ConstPtr &containedType);
+    void rejectIfNonQObjectOut(const QString &error);
 
     QString eqIntExpression(int lhsConst);
     QString argumentsList(int argc, int argv, QString *outVar);

tests/auto/qml/qmlcppcodegen/data/CMakeLists.txt

@@ -3,6 +3,7 @@ set(cpp_sources
     birthdayparty.cpp birthdayparty.h
     cppbaseclass.h
     dynamicmeta.h
+    invisible.h
     objectwithmethod.h
     person.cpp person.h
     state.h
@@ -81,6 +82,7 @@ set(qml_files
     importsFromImportPath.qml
     infinities.qml
     invisibleBase.qml
+    invisibleTypes.qml
     intEnumCompare.qml
     intOverflow.qml
     interactive.qml

tests/auto/qml/qmlcppcodegen/data/invisible.h

@@ -0,0 +1,75 @@
+/****************************************************************************
+**
+** Copyright (C) 2022 The Qt Company Ltd.
+** Contact: https://www.qt.io/licensing/
+**
+** This file is part of the test suite of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:GPL-EXCEPT$
+** Commercial License Usage
+** Licensees holding valid commercial Qt licenses may use this file in
+** accordance with the commercial license agreement provided with the
+** Software or, alternatively, in accordance with the terms contained in
+** a written agreement between you and The Qt Company. For licensing terms
+** and conditions see https://www.qt.io/terms-conditions. For further
+** information use the contact form at https://www.qt.io/contact-us.
+**
+** GNU General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU
+** General Public License version 3 as published by the Free Software
+** Foundation with exceptions as appearing in the file LICENSE.GPL3-EXCEPT
+** included in the packaging of this file. Please review the following
+** information to ensure the GNU General Public License requirements will
+** be met: https://www.gnu.org/licenses/gpl-3.0.html.
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+#ifndef INVISIBLE_H
+#define INVISIBLE_H
+
+#include <QtCore/qobject.h>
+#include <QtQmlIntegration/qqmlintegration.h>
+
+class Invisible : public QObject
+{
+public:
+    Invisible(QObject *parent = nullptr) : QObject(parent) {}
+};
+
+class SingletonModel : public Invisible
+{
+    Q_OBJECT
+    QML_ELEMENT
+    QML_SINGLETON
+public:
+    SingletonModel(QObject *parent = nullptr) : Invisible(parent) {}
+};
+
+class AttachedAttached : public Invisible
+{
+    Q_OBJECT
+public:
+    AttachedAttached(QObject *parent = nullptr) : Invisible(parent) {}
+};
+
+class AttachedObject : public QObject
+{
+    Q_OBJECT
+    QML_ELEMENT
+    QML_ATTACHED(AttachedAttached)
+public:
+    static AttachedAttached *qmlAttachedProperties(QObject *object)
+    {
+        return new AttachedAttached(object);
+    }
+};
+
+class DerivedFromInvisible : public Invisible
+{
+    Q_OBJECT
+    QML_ELEMENT
+};
+
+#endif // INVISIBLE_H

tests/auto/qml/qmlcppcodegen/data/invisibleTypes.qml

@@ -0,0 +1,8 @@
+import QtQml
+import TestTypes
+
+QtObject {
+    property var singleton: SingletonModel
+    property var attached: AttachedObject
+    property var metaobject: DerivedFromInvisible
+}

tests/auto/qml/qmlcppcodegen/tst_qmlcppcodegen.cpp

@@ -130,6 +130,7 @@ private slots:
     void prefixedType();
     void evadingAmbiguity();
     void fromBoolValue();
+    void invisibleTypes();
 };
 
 void tst_QmlCppCodegen::simpleBinding()
@@ -2012,6 +2013,27 @@ void tst_QmlCppCodegen::fromBoolValue()
     QCOMPARE(o->property("b").toBool(), false);
 }
 
+void tst_QmlCppCodegen::invisibleTypes()
+{
+    QQmlEngine engine;
+    QQmlComponent c(&engine, QUrl(u"qrc:/TestTypes/invisibleTypes.qml"_qs));
+    QVERIFY2(c.isReady(), qPrintable(c.errorString()));
+    QScopedPointer<QObject> o(c.create());
+
+    QObject *singleton = qvariant_cast<QObject *>(o->property("singleton"));
+    QVERIFY(singleton != nullptr);
+    QCOMPARE(singleton->metaObject()->className(), "SingletonModel");
+
+    QObject *attached = qvariant_cast<QObject *>(o->property("attached"));
+    QVERIFY(attached != nullptr);
+    QCOMPARE(attached->metaObject()->className(), "AttachedAttached");
+
+// TODO: This doesn't work in interpreted mode:
+//    const QMetaObject *meta = qvariant_cast<const QMetaObject *>(o->property("metaobject"));
+//    QVERIFY(meta != nullptr);
+//    QCOMPARE(meta->className(), "DerivedFromInvisible");
+}
+
 void tst_QmlCppCodegen::runInterpreted()
 {
 #ifdef Q_OS_ANDROID