Change-Id: Ie8572a52a56acad9fab21e5f9fbe5f6e094b1c44
Reviewed-by: Qt Submodule Update Bot <qt_submodule_update_bot@qt-project.org>

The code contained a number of while loops to eat all whitespace or
parse all digits without respecting the end-sentinel. An input string
ending with whitespace or digit results in a possibly unterminated
out-of-bounds read.

To fix this in parsePathDataFast, remove the special handling of
whitespace in this code, and instead just continue the outer loop if the
current character is whitespace.

Pass the end sentinel to the parseNumbersArray and toDouble helpers so
that we can consistently test whether incrementing the str point has
reached the end.

Add test coverage, both to the QML svgpath test case, and to the
QQuickPath test using the private parsePathDataFast API directly. The
input data is the same in both cases. Note that running these tests
without the fix might only fail in an ASAN-enabled build.

Fixes: QTBUG-148526
Change-Id: I3623e97510926b831daaa8b85e1fd5496faf27a1
Reviewed-by: Dimitrios Apostolou <jimis@qt.io>
Reviewed-by: Hatem ElKharashy <hatem.elkharashy@qt.io>
(cherry picked from commit 9ead7460ef95321c837b161b8f7951546711d03e)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
(cherry picked from commit 1854ebceebae5af54d9e32509d61e838c8643585)
(cherry picked from commit 0aba8c7674dbbbaaa142775247249e297a339c85)
Reviewed-by: Akseli Salovaara <akseli.salovaara@qt.io>

merge(QQmlJSRegisterContent, QQmlJSRegisterContent) is tree-recursive:
both mergeScopes() calls in its return statement recurse into it, so
the same (a, b) pair is recomputed along 2^depth paths, allocating a
conversion each time.

Some inputs therefore make qmllint unusable rather than merely slow. On
one 613-line file it reached 313 GB and was OOM-killed after 622 s,
having emitted 36 of that file's 122 warnings.

Memoize merge() on the (a, b) pair, handing out an O(1) clone on a hit.

That shares more registers, but is safe:

- merge() is pure.
- The cache stores and returns clones, so no entry is reachable by
  anything that could edit it. Callers need that anyway: contents
  compare by identity, and mergeRegister() relies on a merge of two
  different contents being freshly tracked.
- Clones are shallow, but no pass edits a register deeper than one
  level. adjustType(), storeType() and generalizeType() only ever take
  a register handed to a pass, or its own storage()/original() chain.
- QQmlJSTypePropagator::run() clears the cache. It is the only caller,
  and the blowup is within one function.

The new test takes 2.3 GB and 11 s unmemoized, 26 MB and 0.03 s
memoized, doubling with every added line.

6.8 is unaffected: its scopes are QQmlJSScope::ConstPtr, so merge()
does not recurse into itself. 6.9 is the first affected branch.

Change-Id: Id65649a837eef59d850b8b8a4ec0412244582488
Reviewed-by: Olivier De Cannière <olivier.decanniere@qt.io>
(cherry picked from commit 6fd46684e04c0ae897bf32a8b38d67ea62bb423c)
Reviewed-by: Jeff Heller <jeffrey_heller@yahoo.com>
(cherry picked from commit db1629f132c65377bdd49ee9d083319286ca9b9f)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
(cherry picked from commit 72122e016bc4359fb5b582bd16c7ec3e34370dd4)
Reviewed-by: Jani Heikkinen <jani.heikkinen@qt.io>

Change-Id: Ifd484d716ae2ae1046c91f79b41a091b0b952b88
Reviewed-by: Qt Submodule Update Bot <qt_submodule_update_bot@qt-project.org>

Change-Id: Ibdb0713b9fad883fe32c5c0b884a22b60a984da5
Reviewed-by: Qt Submodule Update Bot <qt_submodule_update_bot@qt-project.org>

When passing a default constructed Result object, we ignore the result
of the linting. We want to ensure no message are emitted.

Use Result::clean()

Amends 5f3545d930d4cccc4425872ceab38d9b93d7328b

Change-Id: I787833effb268ca6d19f65c6006a9e0a3961472e
Reviewed-by: Sami Shalayel <sami.shalayel@qt.io>
Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>
(cherry picked from commit e2925c562d605d8978816988135e220fbd3df7b1)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
(cherry picked from commit 2165373b8036e2667746428bb2c05f989b35f005)

Change-Id: I8bff31e368dc0429affa6cec6d1d67dc35dca4cc
Reviewed-by: Qt Submodule Update Bot <qt_submodule_update_bot@qt-project.org>

Wrap the implementation of accessibleRoot() in the same
QT_CONFIG(accessibility) guard used in the declaration.

amends 9f13b5971449c7ef8807d457582760ea0dac8c54

Fixes: QTBUG-148578
Pick-to: 6.8
Change-Id: I75b41f6e5e694a3be92757cd2932c86e5c9b3dbd
Reviewed-by: Oliver Eftevaag <oliver.eftevaag@qt.io>
(cherry picked from commit 002aea0f171efcf24d2045ef1708ca7d62be44ee)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
(cherry picked from commit 2f9c5fe60834a993962f281d19bbc6de6e5ce4ac)

In QTBUG-144377, the ToolTip attached property is inherited from
ToolTip's base as ToolTip is defined via a QML file. Adapt the unused
import warning to recognize attached properties from base types.

Amends 8f60ffc42b732951b2b65fea414d6fcbb68dfde2 that introduced the
warning.

Pick-to: 6.8
Fixes: QTBUG-144377
Change-Id: Idc3755cd497c3242ace06db47930f288491712c8
Reviewed-by: Olivier De Cannière <olivier.decanniere@qt.io>
(cherry picked from commit 1ffdd361f603cb50535599ac088401a5d31fedfe)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
(cherry picked from commit 99e4f97503b18629ec8c374ff3c67f519ca73f64)

Change-Id: Ice41771ef04a6779b850a7266b80cf58687404c0
Reviewed-by: Qt Submodule Update Bot <qt_submodule_update_bot@qt-project.org>