QML: Deprecate coercion on type assertions

By using an "as" cast you want to check the type of the value, not
coerce it. Previously, however, if you did this with a value type, it
would create the value type instead of just checking for it.

Add an attribute "Assertable" to the ValueTypeBehavior pragma that
prevents this and enables the correct behavior. Also print a warning
when coercing as part of an as-cast.

[ChangeLog][QtQml] A new attribute "Assertable" has been added to the
"ValueTypeBehavior" pragma. You should always use it if you want to
type-check value types using "as". If you don't use it, an instance of
the type is created as result of the "as" if the type doesn't match.

Task-number: QTBUG-124662
Change-Id: I1d5a6ca0a6f97d7d48440330bed1f9f6472198aa
Reviewed-by: Fabian Kosmale <[email protected]>

11 files changed, 191 insertions, 17 deletions

diff --git a/src/qml/common/qv4compileddata_p.h b/src/qml/common/qv4compileddata_p.h
index 79df230872..c21fc19fa9 100644
--- a/src/qml/common/qv4compileddata_p.h
+++ b/src/qml/common/qv4compileddata_p.h
@@ -1227,6 +1227,7 @@ struct Unit
         NativeMethodsAcceptThisObject = 0x800,
         ValueTypesCopied = 0x1000,
         ValueTypesAddressable = 0x2000,
+        ValueTypesAssertable = 0x4000,
     };
     quint32_le flags;
     quint32_le stringTableSize;
@@ -1706,6 +1707,11 @@ public:
         return unitData()->flags & CompiledData::Unit::ValueTypesAddressable;
     }
 
+    bool valueTypesAreAssertable() const
+    {
+        return unitData()->flags & CompiledData::Unit::ValueTypesAssertable;
+    }
+
     bool componentsAreBound() const
     {
         return unitData()->flags & CompiledData::Unit::ComponentsBound;
diff --git a/src/qml/compiler/qqmlirbuilder.cpp b/src/qml/compiler/qqmlirbuilder.cpp
index a81f8fb1d8..72111b3138 100644
--- a/src/qml/compiler/qqmlirbuilder.cpp
+++ b/src/qml/compiler/qqmlirbuilder.cpp
@@ -861,6 +861,15 @@ private:
                     return true;
                 }
 
+                if (value == "Inassertable"_L1) {
+                    setFlag(Pragma::Assertable, false);
+                    return true;
+                }
+                if (value == "Assertable"_L1) {
+                    setFlag(Pragma::Assertable, true);
+                    return true;
+                }
+
                 return false;
             });
         }
@@ -1718,6 +1727,10 @@ void QmlUnitGenerator::generate(Document &output, const QV4::CompiledData::Depen
                         .testFlag(Pragma::Addressable)) {
                     createdUnit->flags |= Unit::ValueTypesAddressable;
                 }
+                if (Pragma::ValueTypeBehaviorValues(p->valueTypeBehavior)
+                            .testFlag(Pragma::Assertable)) {
+                    createdUnit->flags |= Unit::ValueTypesAssertable;
+                }
                 break;
             case Pragma::Translator:
                 if (createdUnit->translationTableSize)
diff --git a/src/qml/compiler/qqmlirbuilder_p.h b/src/qml/compiler/qqmlirbuilder_p.h
index 546d1fac58..ffd3ad72f7 100644
--- a/src/qml/compiler/qqmlirbuilder_p.h
+++ b/src/qml/compiler/qqmlirbuilder_p.h
@@ -443,6 +443,7 @@ struct Q_QML_COMPILER_EXPORT Pragma
     {
         Copy        = 0x1,
         Addressable = 0x2,
+        Assertable  = 0x4,
     };
     Q_DECLARE_FLAGS(ValueTypeBehaviorValues, ValueTypeBehaviorValue);
 
diff --git a/src/qml/doc/src/qmllanguageref/documents/structure.qdoc b/src/qml/doc/src/qmllanguageref/documents/structure.qdoc
index 5a43ae2028..72a6e08407 100644
--- a/src/qml/doc/src/qmllanguageref/documents/structure.qdoc
+++ b/src/qml/doc/src/qmllanguageref/documents/structure.qdoc
@@ -215,12 +215,6 @@ QtObject {
 }
 \endqml
 
-If the type does not match, casting returns \c undefined. \c instanceof
-only checks for inheritance, not for all possible type coercions. So, for
-example, a \l{QRect} is not a \c rect value type since \c rect is \l{QRectF}
-in C++, and therefore not related by inheritance. With \c as you can cast
-to any type compatible via coercion.
-
 Since \c rect in the above example is now a type name, it will shadow any
 properties called \c{rect}.
 
@@ -231,6 +225,25 @@ able to. You can use \l{qmllint Reference}{qmllint} to find such occurrences.
 There is also a \c{Inaddressable} value you can use to explicitly specify the
 default behavior.
 
+Another attribute to the \c{ValueTypeBehavior} pragma is \c{Assertable},
+introduced in Qt 6.8. Due to a mistake in Qt 6.6 and 6.7 the \c{a as rect} above
+not only checks whether \c{a} is a \c{rect} but also constructs a \c{rect} if
+\c{a} is of a compatible type. This is obviously not what a type assertion
+should do. Specifying \c{Assertable} prevents this behavior and restricts type
+assertions for value types to only check for the type. You should always specify
+it if you are going to use value types with \c{as}. In any case, if the
+type assertion for a value type fails, the result is \c{undefined}.
+
+\c{instanceof} does not have this problem since it only checks for inheritance,
+not for all possible type coercions.
+
+\note Using \c{as} with the \c{int} and \c{double} types is not advisable since by
+JavaScript rules, the result of any calculation is a floating point number, even
+if it happens to hold the same value as its integer equivalent. Conversely, any
+integer constant you declare in JavaScript is not a double by QML's type mapping
+rules. Furthermore, \c{int} and \c{double} are reserved words. You can only
+address these types via type namespaces.
+
 Value types and sequences are generally treated as references. This means, if
 you retrieve a value type instance from a property into a local value, and then
 change the local value, the original property is also changed. Furthermore,
diff --git a/src/qml/jsruntime/qv4executablecompilationunit_p.h b/src/qml/jsruntime/qv4executablecompilationunit_p.h
index 3f3335ef4e..930e138732 100644
--- a/src/qml/jsruntime/qv4executablecompilationunit_p.h
+++ b/src/qml/jsruntime/qv4executablecompilationunit_p.h
@@ -134,6 +134,7 @@ public:
     bool ignoresFunctionSignature() const { return m_compilationUnit->ignoresFunctionSignature(); }
     bool valueTypesAreCopied() const { return m_compilationUnit->valueTypesAreCopied(); }
     bool valueTypesAreAddressable() const { return m_compilationUnit->valueTypesAreAddressable(); }
+    bool valueTypesAreAssertable() const { return m_compilationUnit->valueTypesAreAssertable(); }
     bool componentsAreBound() const { return m_compilationUnit->componentsAreBound(); }
     bool isESModule() const { return m_compilationUnit->isESModule(); }
 
diff --git a/src/qml/jsruntime/qv4runtime.cpp b/src/qml/jsruntime/qv4runtime.cpp
index 8bfe2680f6..184e7c7819 100644
--- a/src/qml/jsruntime/qv4runtime.cpp
+++ b/src/qml/jsruntime/qv4runtime.cpp
@@ -41,6 +41,8 @@
 
 QT_BEGIN_NAMESPACE
 
+Q_LOGGING_CATEGORY(lcCoercingTypeAssertion, "qt.qml.coercingTypeAssertion");
+
 namespace QV4 {
 
 #ifdef QV4_COUNT_RUNTIME_FUNCTIONS
@@ -380,11 +382,25 @@ QV4::ReturnedValue Runtime::As::call(ExecutionEngine *engine, const Value &lval,
     else if (result->isBoolean())
         return Encode::null();
 
+    if (engine->callingQmlContext()->valueTypesAreAssertable())
+        return Encode::undefined();
+
     // Try to convert the value type
-    if (Scoped<QQmlTypeWrapper> typeWrapper(scope, rval); typeWrapper)
-        return coerce(engine, lval, typeWrapper->d()->type(), false);
+    Scoped<QQmlTypeWrapper> typeWrapper(scope, rval);
+    if (!typeWrapper)
+        return Encode::undefined();
 
-    return Encode::undefined();
+    result = coerce(engine, lval, typeWrapper->d()->type(), false);
+    if (result->isUndefined())
+        return Encode::undefined();
+
+    const auto *stackFrame = engine->currentStackFrame;
+    qCWarning(lcCoercingTypeAssertion).nospace().noquote()
+            << stackFrame->source() << ':' << stackFrame->lineNumber() << ':'
+            << " Coercing a value to " << typeWrapper->toQStringNoThrow()
+            << " using a type assertion. This behavior is deprecated."
+            << " Add 'pragma ValueTypeBehavior: Assertable' to prevent it.";
+    return result->asReturnedValue();
 }
 
 QV4::ReturnedValue Runtime::In::call(ExecutionEngine *engine, const Value &left, const Value &right)
diff --git a/src/qml/qml/qqmlcontextdata_p.h b/src/qml/qml/qqmlcontextdata_p.h
index c8e362ec8d..3aeabf72fa 100644
--- a/src/qml/qml/qqmlcontextdata_p.h
+++ b/src/qml/qml/qqmlcontextdata_p.h
@@ -292,6 +292,10 @@ public:
         return m_typeCompilationUnit && m_typeCompilationUnit->valueTypesAreAddressable();
     }
 
+    bool valueTypesAreAssertable() const {
+        return m_typeCompilationUnit && m_typeCompilationUnit->valueTypesAreAssertable();
+    }
+
 private:
     friend class QQmlGuardedContextData;
     friend class QQmlContextPrivate;
diff --git a/src/qml/qml/qqmlirloader.cpp b/src/qml/qml/qqmlirloader.cpp
index b29ce185ef..e1019b804f 100644
--- a/src/qml/qml/qqmlirloader.cpp
+++ b/src/qml/qml/qqmlirloader.cpp
@@ -85,6 +85,8 @@ void QQmlIRLoader::load()
         valueTypeBehavior |= Pragma::Copy;
     if (unit->flags & QV4::CompiledData::Unit::ValueTypesAddressable)
         valueTypeBehavior |= Pragma::Addressable;
+    if (unit->flags & QV4::CompiledData::Unit::ValueTypesAssertable)
+        valueTypeBehavior |= Pragma::Assertable;
     if (valueTypeBehavior)
         createValueTypePragma(Pragma::ValueTypeBehavior, valueTypeBehavior);
 
diff --git a/src/qml/qml/qqmltypewrapper.cpp b/src/qml/qml/qqmltypewrapper.cpp
index 4f65197033..92603b6cad 100644
--- a/src/qml/qml/qqmltypewrapper.cpp
+++ b/src/qml/qml/qqmltypewrapper.cpp
@@ -535,18 +535,37 @@ ReturnedValue QQmlTypeWrapper::virtualInstanceOf(const Object *typeObject, const
         return instanceOfQObject(typeWrapper, objectWrapper);
 
     const QQmlType type = typeWrapper->d()->type();
-    if (type.isValueType()) {
+
+    // If the target type is an object type  we want null.
+    if (!type.isValueType())
+        return Encode(false);
+
+    const auto canCastValueType = [&]() -> bool {
         if (const QQmlValueTypeWrapper *valueWrapper = var.as<QQmlValueTypeWrapper>()) {
-            return QV4::Encode(QQmlMetaObject::canConvert(valueWrapper->metaObject(),
-                                                          type.metaObjectForValueType()));
+            return QQmlMetaObject::canConvert(
+                    valueWrapper->metaObject(), type.metaObjectForValueType());
         }
 
-        // We want "foo as valuetype" to return undefined if it doesn't match.
-        return Encode::undefined();
-    }
+        switch (type.typeId().id()) {
+        case QMetaType::Void:
+            return var.isUndefined();
+        case QMetaType::QVariant:
+            return true; // Everything is a var
+        case QMetaType::Int:
+            return var.isInteger();
+        case QMetaType::Double:
+            return var.isDouble(); // Integers are also doubles
+        case QMetaType::QString:
+            return var.isString();
+        case QMetaType::Bool:
+            return var.isBoolean();
+        }
 
-    // If the target type is an object type  we want null.
-    return Encode(false);
+        return false;
+    };
+
+    // We want "foo as valuetype" to return undefined if it doesn't match.
+    return canCastValueType() ? Encode(true) : Encode::undefined();
 }
 
 ReturnedValue QQmlTypeWrapper::virtualResolveLookupGetter(const Object *object, ExecutionEngine *engine, Lookup *lookup)
diff --git a/tests/auto/qml/qqmllanguage/data/asValueTypeGood.qml b/tests/auto/qml/qqmllanguage/data/asValueTypeGood.qml
new file mode 100644
index 0000000000..7516df8034
--- /dev/null
+++ b/tests/auto/qml/qqmllanguage/data/asValueTypeGood.qml
@@ -0,0 +1,28 @@
+pragma ValueTypeBehavior: Assertable
+import QtQml as Q
+import StaticTest as S
+
+Q.QtObject {
+    property var a
+    property rect b: a as Q.rect
+    property bool c: a instanceof Q.rect
+    property bool d: ({x: 10, y: 20}) instanceof Q.point
+    property var e: ({x: 10, y: 20}) as Q.point
+    property var f: "red" as S.withString
+    property var g: "green" as Q.string
+
+    property var h: new S.withString("red")
+    property var i: {
+        let p = new Q.point;
+        p.x = 10
+        p.y = 20
+        return p
+    }
+
+    property var j: 4.0 as Q.int
+    property var k: (4.5 / 1.5) as Q.int
+    property var l: 5 as Q.double
+    property var m: "something" as Q.var
+    property var n: 1 as Q.bool
+    property var o: Infinity as Q.int
+}
diff --git a/tests/auto/qml/qqmllanguage/tst_qqmllanguage.cpp b/tests/auto/qml/qqmllanguage/tst_qqmllanguage.cpp
index 6a2bb51ee8..a87aabafda 100644
--- a/tests/auto/qml/qqmllanguage/tst_qqmllanguage.cpp
+++ b/tests/auto/qml/qqmllanguage/tst_qqmllanguage.cpp
@@ -410,7 +410,9 @@ private slots:
 
     void objectAndGadgetMethodCallsRejectThisObject();
     void objectAndGadgetMethodCallsAcceptThisObject();
+
     void asValueType();
+    void asValueTypeGood();
 
     void longConversion();
 
@@ -8068,7 +8070,25 @@ void tst_qqmllanguage::asValueType()
 
     QTest::ignoreMessage(
             QtWarningMsg,
+            "Could not find any constructor for value type QQmlRectFValueType "
+            "to call with value undefined");
+
+    QTest::ignoreMessage(
+            QtWarningMsg,
             qPrintable(url.toString() + ":7:5: Unable to assign [undefined] to QRectF"_L1));
+
+    QTest::ignoreMessage(
+            QtWarningMsg,
+            qPrintable(url.toString() + ":10: Coercing a value to QtQml.Base/point using a type "
+                                        "assertion. This behavior is deprecated. Add 'pragma "
+                                        "ValueTypeBehavior: Assertable' to prevent it."_L1));
+
+    QTest::ignoreMessage(
+            QtWarningMsg,
+            qPrintable(url.toString() + ":11: Coercing a value to StaticTest/withString using a "
+                                        "type assertion. This behavior is deprecated. Add 'pragma "
+                                        "ValueTypeBehavior: Assertable' to prevent it."_L1));
+
     QScopedPointer<QObject> o(c.create());
 
     QCOMPARE(o->property("a"), QVariant());
@@ -8093,6 +8113,57 @@ void tst_qqmllanguage::asValueType()
     QCOMPARE(string.toString(), u"green");
 }
 
+void tst_qqmllanguage::asValueTypeGood()
+{
+    QQmlEngine engine;
+    const QUrl url = testFileUrl("asValueTypeGood.qml");
+    QQmlComponent c(&engine, url);
+    QVERIFY2(c.isReady(), qPrintable(c.errorString()));
+
+    QTest::ignoreMessage(
+            QtWarningMsg,
+            qPrintable(url.toString() + ":7:5: Unable to assign [undefined] to QRectF"_L1));
+    QScopedPointer<QObject> o(c.create());
+
+    QCOMPARE(o->property("a"), QVariant());
+    QCOMPARE(o->property("b").value<QRectF>(), QRectF());
+    QVERIFY(!o->property("c").toBool());
+
+    const QRectF rect(1, 2, 3, 4);
+    o->setProperty("a", QVariant(rect));
+    QCOMPARE(o->property("b").value<QRectF>(), rect);
+    QVERIFY(o->property("c").toBool());
+
+    QVERIFY(!o->property("d").toBool());
+    QVERIFY(!o->property("e").isValid());
+    QVERIFY(!o->property("f").isValid());
+
+    const QVariant string = o->property("g");
+    QCOMPARE(string.metaType(), QMetaType::fromType<QString>());
+    QCOMPARE(string.toString(), u"green");
+
+    const ValueTypeWithString withString = o->property("h").value<ValueTypeWithString>();
+    QCOMPARE(withString.toString(), u"red");
+
+    const QPointF point = o->property("i").value<QPointF>();
+    QCOMPARE(point.x(), 10.0);
+    QCOMPARE(point.y(), 20.0);
+
+    const QVariant j = o->property("j");
+    QCOMPARE(j.metaType(), QMetaType::fromType<int>());
+    QCOMPARE(j.toInt(), 4);
+
+    QVERIFY(!o->property("k").isValid());
+    QVERIFY(!o->property("l").isValid());
+
+    const QVariant m = o->property("m");
+    QCOMPARE(m.metaType(), QMetaType::fromType<QString>());
+    QCOMPARE(m.toString(), u"something");
+
+    QVERIFY(!o->property("n").isValid());
+    QVERIFY(!o->property("o").isValid());
+}
+
 void tst_qqmllanguage::typedEnums_data()
 {
     QTest::addColumn<QString>("property");