Fix qobject_cast on partially destroyed QWidget/QWindow

QWidget and QWindow use bits in QObjectPrivate to provide for a couple
of shortcuts -- one in qobject_cast, and another in the isWidgetType() /
isWindowType() functions in QObject. These can be optimized by simply
looking at the bits, without actually doing more expensive runtime
casts.

These bits were set on construction, but not unset on destruction.  The
result was for instance that destroying a QWidget would report that the
object was still a QWidget when ~QObject was reached.

Fix this

1) by setting the bits only when QWidget / QWindow constructors start;

2) by resetting the bits once ~QWidget / ~QWindow are completed.
Technically speaking this is not 100% correct in the presence of data
members, but luckily those classes don't have any.

Amend an existing test for QWidget (whose comment said exactly the
opposite of what the test actually did) and add a test for QWindow.

Some other code was wrongly relying on isWidgetType() returning true
for destroyed QWidgets; amend it as needed.

[ChangeLog][QtCore][QObject] Using qobject_cast on partially constructed
or destroyed QWidget/QWindow instances now yields correct results.
Similarly, using the convenience isWidgetType() / isWindowType()
functions now correctly return false on such instances. Before,
qobject_cast (and the convenience functions) would erroneously report
that a given object was a QWidget (resp. QWindow) even during that
object's construction (before QObject's constructor had completed) or
destruction (after QWidget's (resp. QWindow's) destructors had been
completed). This was semantically wrong and inconsistent with other ways
of gathering runtime type information regarding such an object (e.g.
dynamic_cast, obj->metaObject()->className() and so on).

Pick-to: 6.3
Change-Id: Ic45a887951755a9d1a3b838590f1e9f2c4ae6e92
Reviewed-by: Qt CI Bot <qt_ci_bot@qt-project.org>
Reviewed-by: Marc Mutz <marc.mutz@qt.io>
Reviewed-by: Tor Arne Vestbø <tor.arne.vestbo@qt.io>

2 files changed, 74 insertions, 20 deletions

diff --git a/tests/auto/gui/kernel/qwindow/tst_qwindow.cpp b/tests/auto/gui/kernel/qwindow/tst_qwindow.cpp
index ff5a670322..46d6f5bf44 100644
--- a/tests/auto/gui/kernel/qwindow/tst_qwindow.cpp
+++ b/tests/auto/gui/kernel/qwindow/tst_qwindow.cpp
@@ -110,6 +110,7 @@ private slots:
     void generatedMouseMove();
     void keepPendingUpdateRequests();
     void activateDeactivateEvent();
+    void qobject_castOnDestruction();
 
 private:
     QPoint m_availableTopLeft;
@@ -2744,6 +2745,19 @@ void tst_QWindow::activateDeactivateEvent()
     QCOMPARE(w2.activateCount, 1);
 }
 
+// Test that in a slot connected to destroyed() the emitter is
+// is no longer a QWindow.
+void tst_QWindow::qobject_castOnDestruction()
+{
+    QWindow window;
+    QObject::connect(&window, &QObject::destroyed, [](QObject *object)
+    {
+        QVERIFY(!qobject_cast<QWindow *>(object));
+        QVERIFY(!dynamic_cast<QWindow *>(object));
+        QVERIFY(!object->isWindowType());
+    });
+}
+
 #include <tst_qwindow.moc>
 QTEST_MAIN(tst_QWindow)
 
diff --git a/tests/auto/widgets/kernel/qwidget/tst_qwidget.cpp b/tests/auto/widgets/kernel/qwidget/tst_qwidget.cpp
index 42f336bc0b..a3698de203 100644
--- a/tests/auto/widgets/kernel/qwidget/tst_qwidget.cpp
+++ b/tests/auto/widgets/kernel/qwidget/tst_qwidget.cpp
@@ -247,7 +247,7 @@ private slots:
     void closeAndShowNativeChild();
     void closeAndShowWithNativeChild();
     void transientParent();
-    void qobject_castInDestroyedSlot();
+    void qobject_castOnDestruction();
 
     void showHideEvent_data();
     void showHideEvent();
@@ -5390,34 +5390,74 @@ void tst_QWidget::scrollNativeChildren()
 
 #endif // Mac OS
 
-class DestroyedSlotChecker : public QObject
+/*
+    This class is used as a slot object to test two different steps of
+    QWidget destruction.
+
+    The first step is connecting the destroyed() signal to an object of
+    this class (through its operator()). In widgets, destroyed() is
+    emitted by ~QWidget, and not by ~QObject. This means that in our
+    operator() we expect the sender of the signal to still be a
+    QWidget.
+
+    The connection realized at the first step means that now there's
+    an instance of this class owned by the sender object. That instance
+    is destroyed when the signal/slot connections are destroyed.
+    That happens in ~QObject, not in ~QWidget. Therefore, in the
+    destructor of this class, check that indeed the target is no longer
+    a QWidget but just a QObject.
+*/
+class QObjectCastChecker
 {
-    Q_OBJECT
-
 public:
-    bool wasQWidget = false;
+    explicit QObjectCastChecker(QWidget *target)
+        : m_target(target)
+    {
+    }
 
-public slots:
-    void destroyedSlot(QObject *object)
+    ~QObjectCastChecker()
     {
-        wasQWidget = (qobject_cast<QWidget *>(object) != nullptr || object->isWidgetType());
+        if (!m_target)
+            return;
+
+        // When ~QObject is reached, check that indeed the object is no
+        // longer a QWidget. This relies on slots being disconnected in
+        // ~QObject (and this "slot object" being destroyed there).
+        QVERIFY(!qobject_cast<QWidget *>(m_target));
+        QVERIFY(!dynamic_cast<QWidget *>(m_target));
+        QVERIFY(!m_target->isWidgetType());
     }
-};
 
-/*
-    Test that qobject_cast<QWidget*> returns 0 in a slot
-    connected to QObject::destroyed.
-*/
-void tst_QWidget::qobject_castInDestroyedSlot()
-{
-    DestroyedSlotChecker checker;
+    QObjectCastChecker(QObjectCastChecker &&other) noexcept
+        : m_target(qExchange(other.m_target, nullptr))
+    {}
 
-    QWidget *widget = new QWidget();
+    QT_MOVE_ASSIGNMENT_OPERATOR_IMPL_VIA_MOVE_AND_SWAP(QObjectCastChecker)
 
-    QObject::connect(widget, &QObject::destroyed, &checker, &DestroyedSlotChecker::destroyedSlot);
-    delete widget;
+    void swap(QObjectCastChecker &other) noexcept
+    {
+        qSwap(m_target, other.m_target);
+    }
+
+    void operator()(QObject *object) const
+    {
+        // Test that in a slot connected to destroyed() the emitter is
+        // still a QWidget. This is because ~QWidget() itself emits the
+        // signal.
+        QVERIFY(qobject_cast<QWidget *>(object));
+        QVERIFY(dynamic_cast<QWidget *>(object));
+        QVERIFY(object->isWidgetType());
+    }
 
-    QVERIFY(checker.wasQWidget);
+private:
+    Q_DISABLE_COPY(QObjectCastChecker)
+    QObject *m_target;
+};
+
+void tst_QWidget::qobject_castOnDestruction()
+{
+    QWidget widget;
+    QObject::connect(&widget, &QObject::destroyed, QObjectCastChecker(&widget));
 }
 
 // Since X11 WindowManager operations are all async, and we have no way to know if the window