QmlCompiler: Guard against ID-lookup of value types

Pick-to: 6.5 6.2
Task-number: QTBUG-111986
Change-Id: I10657e4176b5f57f3552728d8b2835e74b82bb60
Reviewed-by: Qt CI Bot <qt_ci_bot@qt-project.org>
Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>

src/qmlcompiler/qqmljstypepropagator.cpp

@@ -595,11 +595,26 @@ void QQmlJSTypePropagator::generate_LoadQmlContextPropertyLookup(int index)
     if (!m_state.accumulatorOut().isValid()) {
         setError(u"Cannot access value for name "_s + name);
         handleUnqualifiedAccess(name, false);
-    } else if (m_typeResolver->genericType(m_state.accumulatorOut().storedType()).isNull()) {
+        return;
+    }
+
+    const QQmlJSScope::ConstPtr outStored
+            = m_typeResolver->genericType(m_state.accumulatorOut().storedType());
+
+    if (outStored.isNull()) {
         // It should really be valid.
         // We get the generic type from aotContext->loadQmlContextPropertyIdLookup().
         setError(u"Cannot determine generic type for "_s + name);
-    } else if (m_passManager != nullptr) {
+        return;
+    }
+
+    if (m_state.accumulatorOut().variant() == QQmlJSRegisterContent::ObjectById
+            && !outStored->isReferenceType()) {
+        setError(u"Cannot retrieve a non-object type by ID: "_s + name);
+        return;
+    }
+
+    if (m_passManager != nullptr) {
         m_passManager->analyzeRead(m_function->qmlScope, name, m_function->qmlScope,
                                    getCurrentSourceLocation());
     }

tests/auto/qml/qmllint/data/Things/plugins.qmltypes

@@ -96,4 +96,12 @@ Module {
        Property { name: "foo"; type: "string" }
        hasCustomParser: true
     }
+    Component {
+        file: "mediaplayer-qml.h"
+        name: "MediaPlayerStateMachine"
+        accessSemantics: "value"
+        exports: ["Mediaplayer/MediaPlayerStateMachine 1.0"]
+        isCreatable: false
+        exportMetaObjectRevisions: [256]
+    }
 }

tests/auto/qml/qmllint/data/invalidIdLookup.qml

@@ -0,0 +1,10 @@
+import Things
+import QtQml
+
+QtObject {
+    property MediaPlayerStateMachine m: MediaPlayerStateMachine {
+        id: stateMachine
+    }
+
+    objectName: stateMachine.objectName
+}

tests/auto/qml/qmllint/tst_qmllint.cpp

@@ -1269,6 +1269,12 @@ void TestQmllint::compilerWarnings_data()
                        "Cannot resolve property type  for binding on myColor. "
                        "You may want use ID-based grouped properties here.") } } }
             << true;
+    QTest::newRow("invalidIdLookup")
+            << QStringLiteral("invalidIdLookup.qml")
+            << Result { { {
+                    QStringLiteral("Cannot retrieve a non-object type by ID: stateMachine")
+               } } }
+            << true;
 }
 
 void TestQmllint::compilerWarnings()