qt/qtdeclarative.git, branch dev

QML: Warn about executable remote content from untrusted sources

2026-06-25T19:37:45+00:00

First, mention that WorkerScript also supports network transparency
since 6.11.
Then, add a warning to the section pointing to the existing
documentation on handling untrusted sources.

Amends 2692b14cfb702ec4b50f05f743babba5973547e4

Pick-to: 6.12 6.11
Task-number: QTBUG-147487
Change-Id: I4ab3635dce5e0faa31d78bdaf4888eb131cd4abf
Reviewed-by: Ulf Hermann

QML: Caution against creating dynamic objects from untrusted input

2026-06-25T19:37:43+00:00

It is equally unwise to create QML objects dynamically from untrusted
sources as it is to create them statically from such sources.
Adjust the documentation centrally, instead of adding a snippet to each
relevant function as
a) they all link to the page already and
b) createQmlObject would otherwise have more warnings than other
   documentation.

Task-number: QTBUG-147487
Pick-to: 6.12 6.11 6.8
Change-Id: Icfb3e2d951633ad445aed935112a60df32383be7
Reviewed-by: Ulf Hermann

Qt.callLater: Fix crash with invalidated context

2026-06-25T19:37:41+00:00

An invalidated context might still be linked, and a function queued by
callLater might access it. A name-lookup in it would trigger
initPropertyNames, which at that point would dereference a null pointer
because we try to access the nulled engine.

Part of the issue lies in the fact that creating an IdentifierHash
requires a handle even for an always empty hash. Changing this is left
for another patch.

The crash appears in KDE's Sentry as issue
6fe76d02b7ad41aea6a0e7689a59c11e
Reproducer crafted via AI.

Most likely amends 054873dfea0ce07c94bb603edc3b7d61a6190c4f, which
caused Loader to drop the engine from the context.

Pick-to: 6.12 6.11 6.8 6.5
Task-number: QTBUG-142387
Task-number: QTBUG-104016
Change-Id: I92b0e91dea3e23d448fc4a3d3a4291cc9c7a260e
Reviewed-by: Ulf Hermann

qmllint: Protect against empty statement lists in possibleLastStatements

2026-06-25T19:37:39+00:00

The function is used as part of the useless expression check, and had an
assert against the linked list head being nullptr. However, this can
happen in practice: The linked bug triggered it via a switch-case, but
it's also possible with an empty block.

As there are multiple path potentially leading to the issue, fix it once
by turning the assert into a defensive check.

Fixes: QTBUG-147697
Pick-to: 6.12
Change-Id: Iee1fa0e98d0195810953a16af200d808e5eb55fa
Reviewed-by: Olivier De Cannière

Qt.labs: Fix vesioned imports of older vesions

2026-06-25T19:37:28+00:00

The labs types were introduced with version 1.0, but importing that
revision broke recently when we exposed the types under the Qt
major.minor version.

Amends 5c27e34d9166916823f031c7f21611da06148baa, which only added
PAST_MAJOR_VERSIONS, but neglected to add QML_ADDED_IN_VERSION to the
C++ registered types.

Pick-to: 6.12
Change-Id: I402e827c96e46dc714416a4836d7c8a231a091e9
Reviewed-by: Ulf Hermann 
Reviewed-by: Olivier De Cannière

StyleKit: Implement SearchField

2026-06-24T19:35:48+00:00

Pick-to: 6.12
Change-Id: I67979ae1f092248c48a5ff9ee8f36d5085562c33
Reviewed-by: Richard Moe Gustavsen

QtQml: remove unnecessary refcount up and down

2026-06-24T19:35:41+00:00

This was probably an artifact of how the code evolved, but we don't need
to go through the intermediate QPropertyBindingPrivatePtr (a
QExplicicitlySharedDataPointer replacement).

Pick-to: 6.12
Change-Id: Id850d002ec5e2c1807f2fffd71a8d87ff24be5df
Reviewed-by: Ulf Hermann

QtQml: use QPropertyBindingPrivate::makeUntyped()

2026-06-24T19:35:36+00:00

The constructor we're trying to access in QUntypedPropertyBinding is
going to be made private.

Pick-to: 6.12
Task-number: QTBUG-147406
Change-Id: I80f9ed6e1023db0189d5fffd947c8b318be69194
Reviewed-by: Fabian Kosmale

qqmljsimporter: Drop warning in unusual setup

2026-06-24T19:35:31+00:00

A redirect via prefer to a non-qrc path is already rather rare, as most
of the prefer statements are generated by the QML CMake API.
An even rarer case is when there's no qmldir at the redirect location.
We so far emitted a warning for it (as an internal indicator that
something unusual happens), however, one can consider it to be a valid
use case.
And our design tooling would actually like to make use of the
functionality to pick up modified QML files from the source directory
without having to rerun qmlcachegen (during development).
As this use-case, while unusual, works in practice, we drop the warning.

Pick-to: 6.12 6.11
Change-Id: I7e146882df3c649c690e6095284f6f2902558061
Reviewed-by: Ulf Hermann

qmllint: Warn on invalid shorthand property initializers

2026-06-24T19:35:25+00:00

Adds warningsForAssignments() to the Pattern/PatternElement/
PatternProperty AST nodes, which detects CoverInitializedName-style
shorthand property
assignments (e.g. { x = 42 }) inside object literals and reports them
as "Invalid shorthand property initializer" warnings, matching
V8/Node.js behavior.

The warning is deferred using a m_pendingCoverDiagnostics list in
Parser. ObjectLiteral reductions record warnings there; they are only
promoted to diagnostic_messages at parse completion if the node's
parseMode is still Literal, meaning it was never reinterpreted as a
destructuring pattern via convertLiteralToAssignmentPattern(). This
avoids false positives for ({ a = 1 } = {}) and
({ a = 0 } = {}) => a, which are valid destructuring patterns that
happen to be parsed through the same cover grammar.

This commit was co-written by AI.

Fixes: QTBUG-146961
Change-Id: Ibcab7f0522af9f926ce559facae8e3466406c1d8
Reviewed-by: Olivier De Cannière