Repair QQmlGadgetPtrWrapper's metaObject

We need two metaobjects: One with the PropertyAccessInStaticMetaCall
flagg and one without. The one without needs to be used with
QQmlGadgetPtrWrapper, since the wrapper wants to intercept metacalls.
The other one needs to be used when calling readOnGadget(). We can
accommodate this by just retaining the original metaobject. As it's
retrieved from a gadget type you should definitely be able to
readOnGadget() with it. The dynamic meta object, on the other hand, can
be lazily created when we actually metacall() through
QQmlGadgetPtrWrapper.

This relieves us of all the special casing around QQmlGadgetPtrWrapper
and makes it safe to use for anyone.

Fixes: QTBUG-108704
Change-Id: Icc01c81babaa9d1eca8d5ddfaf44d724a404db38
Reviewed-by: Qt CI Bot <qt_ci_bot@qt-project.org>
Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>

7 files changed, 59 insertions, 64 deletions

diff --git a/src/plugins/qmltooling/qmldbg_debugger/qqmlenginedebugservice.cpp b/src/plugins/qmltooling/qmldbg_debugger/qqmlenginedebugservice.cpp
index 578b07cb22..1fcc1e7772 100644
--- a/src/plugins/qmltooling/qmldbg_debugger/qqmlenginedebugservice.cpp
+++ b/src/plugins/qmltooling/qmldbg_debugger/qqmlenginedebugservice.cpp
@@ -147,8 +147,7 @@ QQmlEngineDebugServiceImpl::propertyData(QObject *obj, int propIdx)
 {
     QQmlObjectProperty rv;
 
-    const QMetaObject *metaObject = obj->metaObject();
-    QMetaProperty prop = metaObject->property(propIdx);
+    QMetaProperty prop = obj->metaObject()->property(propIdx);
 
     rv.type = QQmlObjectProperty::Unknown;
     rv.valueTypeName = QString::fromUtf8(prop.typeName());
@@ -159,10 +158,7 @@ QQmlEngineDebugServiceImpl::propertyData(QObject *obj, int propIdx)
     if (binding)
         rv.binding = binding->expression();
 
-    if (metaObject->metaType().flags().testFlag(QMetaType::IsGadget))
-        rv.value = valueContents(static_cast<QQmlGadgetPtrWrapper *>(obj)->readOnGadget(prop));
-    else
-        rv.value = valueContents(prop.read(obj));
+    rv.value = valueContents(prop.read(obj));
 
     if (prop.metaType().flags().testFlag(QMetaType::PointerToQObject))  {
         rv.type = QQmlObjectProperty::Object;
diff --git a/src/plugins/qmltooling/qmldbg_debugger/qqmlwatcher.cpp b/src/plugins/qmltooling/qmldbg_debugger/qqmlwatcher.cpp
index 7a7d2f37b4..d72c11d439 100644
--- a/src/plugins/qmltooling/qmldbg_debugger/qqmlwatcher.cpp
+++ b/src/plugins/qmltooling/qmldbg_debugger/qqmlwatcher.cpp
@@ -40,7 +40,6 @@ private:
     int m_id;
     QQmlWatcher *m_watch;
     QObject *m_object;
-    bool m_isGadget;
     int m_debugId;
     QMetaProperty m_property;
 
@@ -52,7 +51,6 @@ QQmlWatchProxy::QQmlWatchProxy(int id, QQmlExpression *exp, int debugId, QQmlWat
       m_id(id),
       m_watch(parent),
       m_object(nullptr),
-      m_isGadget(false),
       m_debugId(debugId),
       m_expr(exp)
 {
@@ -66,7 +64,6 @@ QQmlWatchProxy::QQmlWatchProxy(int id, QObject *object, int debugId, const QMeta
       m_id(id),
       m_watch(parent),
       m_object(object),
-      m_isGadget(typeid(*m_object) == typeid(QQmlGadgetPtrWrapper)),
       m_debugId(debugId),
       m_property(prop),
       m_expr(nullptr)
@@ -84,8 +81,6 @@ void QQmlWatchProxy::notifyValueChanged()
     QVariant v;
     if (m_expr)
         v = m_expr->evaluate();
-    else if (m_isGadget)
-        v = static_cast<QQmlGadgetPtrWrapper *>(m_object)->readOnGadget(m_property);
     else
         v = m_property.read(m_object);
     emit m_watch->propertyChanged(m_id, m_debugId, m_property, v);
diff --git a/src/qml/qml/qqmlbinding.cpp b/src/qml/qml/qqmlbinding.cpp
index 0116251fb8..cd4af5c839 100644
--- a/src/qml/qml/qqmlbinding.cpp
+++ b/src/qml/qml/qqmlbinding.cpp
@@ -254,7 +254,7 @@ protected:
                 break;
             default:
                 if (const QV4::QQmlValueTypeWrapper *vtw = result.as<const QV4::QQmlValueTypeWrapper>()) {
-                    if (vtw->d()->valueType()->metaType == pd->propType()) {
+                    if (vtw->d()->valueType()->metaType() == pd->propType()) {
                         return vtw->write(m_target.data(), pd->coreIndex());
                     }
                 }
diff --git a/src/qml/qml/qqmlvaluetype.cpp b/src/qml/qml/qqmlvaluetype.cpp
index cf11a3f06d..f234cb1312 100644
--- a/src/qml/qml/qqmlvaluetype.cpp
+++ b/src/qml/qml/qqmlvaluetype.cpp
@@ -11,20 +11,9 @@
 
 QT_BEGIN_NAMESPACE
 
-QQmlValueType::QQmlValueType(QMetaType type, const QMetaObject *gadgetMetaObject)
-    : metaType(type)
-{
-    QMetaObjectBuilder builder(gadgetMetaObject);
-
-    // This is required for calling readOnGadget() on properties from this metaObject.
-    builder.setFlags(PropertyAccessInStaticMetaCall);
-
-    dynamicMetaObject = builder.toMetaObject();
-}
-
 QQmlValueType::~QQmlValueType()
 {
-    ::free(dynamicMetaObject);
+    ::free(m_dynamicMetaObject);
 }
 
 QQmlGadgetPtrWrapper *QQmlGadgetPtrWrapper::instance(QQmlEngine *engine, QMetaType type)
@@ -54,7 +43,7 @@ void QQmlGadgetPtrWrapper::read(QObject *obj, int idx)
     QMetaObject::metacall(obj, QMetaObject::ReadProperty, idx, a);
 }
 
-void QQmlGadgetPtrWrapper::write(QObject *obj, int idx, QQmlPropertyData::WriteFlags flags)
+void QQmlGadgetPtrWrapper::write(QObject *obj, int idx, QQmlPropertyData::WriteFlags flags) const
 {
     Q_ASSERT(m_gadgetPtr);
     int status = -1;
@@ -62,16 +51,16 @@ void QQmlGadgetPtrWrapper::write(QObject *obj, int idx, QQmlPropertyData::WriteF
     QMetaObject::metacall(obj, QMetaObject::WriteProperty, idx, a);
 }
 
-QVariant QQmlGadgetPtrWrapper::value()
+QVariant QQmlGadgetPtrWrapper::value() const
 {
     Q_ASSERT(m_gadgetPtr);
-    return QVariant(QMetaType(metaTypeId()), m_gadgetPtr);
+    return QVariant(metaType(), m_gadgetPtr);
 }
 
 void QQmlGadgetPtrWrapper::setValue(const QVariant &value)
 {
     Q_ASSERT(m_gadgetPtr);
-    Q_ASSERT(metaTypeId() == value.userType());
+    Q_ASSERT(metaType() == value.metaType());
     const QQmlValueType *type = valueType();
     type->destruct(m_gadgetPtr);
     type->construct(m_gadgetPtr, value.constData());
@@ -80,7 +69,7 @@ void QQmlGadgetPtrWrapper::setValue(const QVariant &value)
 int QQmlGadgetPtrWrapper::metaCall(QMetaObject::Call type, int id, void **argv)
 {
     Q_ASSERT(m_gadgetPtr);
-    const QMetaObject *metaObject = valueType()->metaObject();
+    const QMetaObject *metaObject = valueType()->staticMetaObject();
     QQmlMetaObject::resolveGadgetMethodOrPropertyIndex(type, &metaObject, &id);
     metaObject->d.static_metacall(static_cast<QObject *>(m_gadgetPtr), type, id, argv);
     return id;
@@ -94,7 +83,16 @@ const QQmlValueType *QQmlGadgetPtrWrapper::valueType() const
 
 QMetaObject *QQmlValueType::toDynamicMetaObject(QObject *)
 {
-    return dynamicMetaObject;
+    if (!m_dynamicMetaObject) {
+        QMetaObjectBuilder builder(m_staticMetaObject);
+
+        // Do not set PropertyAccessInStaticMetaCall here. QQmlGadgetPtrWrapper likes to
+        // to intercept the metacalls since it needs to use its gadgetPtr.
+        // For QQmlValueType::metaObject() we use the base type that has the flag.
+
+        m_dynamicMetaObject = builder.toMetaObject();
+    }
+    return m_dynamicMetaObject;
 }
 
 void QQmlValueType::objectDestroyed(QObject *)
diff --git a/src/qml/qml/qqmlvaluetype_p.h b/src/qml/qml/qqmlvaluetype_p.h
index afc261e06b..779ba01f12 100644
--- a/src/qml/qml/qqmlvaluetype_p.h
+++ b/src/qml/qml/qqmlvaluetype_p.h
@@ -32,18 +32,20 @@ QT_BEGIN_NAMESPACE
 class Q_QML_PRIVATE_EXPORT QQmlValueType : public QDynamicMetaObjectData
 {
 public:
-    QQmlValueType() : metaType(QMetaType::UnknownType) {}
-    QQmlValueType(QMetaType type, const QMetaObject *metaObject);
+    QQmlValueType() = default;
+    QQmlValueType(QMetaType type, const QMetaObject *staticMetaObject)
+        : m_metaType(type), m_staticMetaObject(staticMetaObject)
+    {}
     ~QQmlValueType();
 
-    void *create() const { return metaType.create(); }
-    void destroy(void *gadgetPtr) const { metaType.destroy(gadgetPtr); }
+    void *create() const { return m_metaType.create(); }
+    void destroy(void *gadgetPtr) const { m_metaType.destroy(gadgetPtr); }
 
-    void construct(void *gadgetPtr, const void *copy) const { metaType.construct(gadgetPtr, copy); }
-    void destruct(void *gadgetPtr) const { metaType.destruct(gadgetPtr); }
+    void construct(void *gadgetPtr, const void *copy) const { m_metaType.construct(gadgetPtr, copy); }
+    void destruct(void *gadgetPtr) const { m_metaType.destruct(gadgetPtr); }
 
-    int metaTypeId() const { return metaType.id(); }
-    const QMetaObject *metaObject() const { return dynamicMetaObject; }
+    QMetaType metaType() const { return m_metaType; }
+    const QMetaObject *staticMetaObject() const { return m_staticMetaObject; }
 
     // ---- dynamic meta object data interface
     QMetaObject *toDynamicMetaObject(QObject *) override;
@@ -51,9 +53,10 @@ public:
     int metaCall(QObject *obj, QMetaObject::Call type, int _id, void **argv) override;
     // ----
 
-public:
-    QMetaType metaType;
-    QMetaObject *dynamicMetaObject = nullptr;
+private:
+    QMetaType m_metaType;
+    const QMetaObject *m_staticMetaObject = nullptr;
+    QMetaObject *m_dynamicMetaObject = nullptr;
 };
 
 class Q_QML_PRIVATE_EXPORT QQmlGadgetPtrWrapper : public QObject
@@ -66,14 +69,18 @@ public:
     ~QQmlGadgetPtrWrapper();
 
     void read(QObject *obj, int idx);
-    void write(QObject *obj, int idx, QQmlPropertyData::WriteFlags flags);
-    QVariant value();
+    void write(QObject *obj, int idx, QQmlPropertyData::WriteFlags flags) const;
+    QVariant value() const;
     void setValue(const QVariant &value);
 
-    int metaTypeId() const { return valueType()->metaTypeId(); }
+    QMetaType metaType() const { return valueType()->metaType(); }
     int metaCall(QMetaObject::Call type, int id, void **argv);
 
-    QMetaProperty property(int index) { return valueType()->metaObject()->property(index); }
+    QMetaProperty property(int index) const
+    {
+        return valueType()->staticMetaObject()->property(index);
+    }
+
     QVariant readOnGadget(const QMetaProperty &property) const
     {
         return property.readOnGadget(m_gadgetPtr);
@@ -86,7 +93,6 @@ public:
 
 private:
     const QQmlValueType *valueType() const;
-
     void *m_gadgetPtr = nullptr;
 };
 
diff --git a/src/qml/qml/qqmlvaluetypewrapper.cpp b/src/qml/qml/qqmlvaluetypewrapper.cpp
index 561b2f888d..e489a0d43f 100644
--- a/src/qml/qml/qqmlvaluetypewrapper.cpp
+++ b/src/qml/qml/qqmlvaluetypewrapper.cpp
@@ -51,7 +51,7 @@ Heap::QQmlValueTypeWrapper *Heap::QQmlValueTypeWrapper::detached() const
 void Heap::QQmlValueTypeWrapper::destroy()
 {
     if (m_gadgetPtr) {
-        m_valueType->metaType.destruct(m_gadgetPtr);
+        m_valueType->metaType().destruct(m_gadgetPtr);
         ::operator delete(m_gadgetPtr);
     }
     ReferenceObject::destroy();
@@ -60,16 +60,16 @@ void Heap::QQmlValueTypeWrapper::destroy()
 void Heap::QQmlValueTypeWrapper::setData(const void *data)
 {
     if (auto *gadget = gadgetPtr())
-        valueType()->metaType.destruct(gadget);
+        valueType()->metaType().destruct(gadget);
     if (!gadgetPtr())
-        setGadgetPtr(::operator new(valueType()->metaType.sizeOf()));
-    valueType()->metaType.construct(gadgetPtr(), data);
+        setGadgetPtr(::operator new(valueType()->metaType().sizeOf()));
+    valueType()->metaType().construct(gadgetPtr(), data);
 }
 
 QVariant Heap::QQmlValueTypeWrapper::toVariant() const
 {
     Q_ASSERT(gadgetPtr());
-    return QVariant(valueType()->metaType, gadgetPtr());
+    return QVariant(valueType()->metaType(), gadgetPtr());
 }
 
 bool Heap::QQmlValueTypeWrapper::setVariant(const QVariant &variant)
@@ -77,7 +77,7 @@ bool Heap::QQmlValueTypeWrapper::setVariant(const QVariant &variant)
     Q_ASSERT(isVariant());
 
     const QMetaType variantReferenceType = variant.metaType();
-    if (variantReferenceType != valueType()->metaType) {
+    if (variantReferenceType != valueType()->metaType()) {
         // This is a stale VariantReference.  That is, the variant has been
         // overwritten with a different type in the meantime.
         // We need to modify this reference to the updated value type, if
@@ -85,7 +85,7 @@ bool Heap::QQmlValueTypeWrapper::setVariant(const QVariant &variant)
         if (QQmlMetaType::isValueType(variantReferenceType)) {
             const QMetaObject *mo = QQmlMetaType::metaObjectForValueType(variantReferenceType);
             if (gadgetPtr()) {
-                valueType()->metaType.destruct(gadgetPtr());
+                valueType()->metaType().destruct(gadgetPtr());
                 ::operator delete(gadgetPtr());
             }
             setGadgetPtr(nullptr);
@@ -105,8 +105,8 @@ bool Heap::QQmlValueTypeWrapper::setVariant(const QVariant &variant)
 void *Heap::QQmlValueTypeWrapper::storagePointer()
 {
     if (!gadgetPtr()) {
-        setGadgetPtr(::operator new(valueType()->metaType.sizeOf()));
-        valueType()->metaType.construct(gadgetPtr(), nullptr);
+        setGadgetPtr(::operator new(valueType()->metaType().sizeOf()));
+        valueType()->metaType().construct(gadgetPtr(), nullptr);
     }
     return gadgetPtr();
 }
@@ -243,7 +243,7 @@ bool QQmlValueTypeWrapper::toGadget(void *data) const
 {
     if (d()->isReference() && !readReferenceValue())
         return false;
-    const QMetaType type = d()->valueType()->metaType;
+    const QMetaType type = d()->valueType()->metaType();
     type.destruct(data);
     type.construct(data, d()->gadgetPtr());
     return true;
@@ -539,12 +539,12 @@ bool QQmlValueTypeWrapper::isEqual(const QVariant& value) const
 
 int QQmlValueTypeWrapper::typeId() const
 {
-    return d()->valueType()->metaType.id();
+    return d()->valueType()->metaType().id();
 }
 
 QMetaType QQmlValueTypeWrapper::type() const
 {
-    return d()->valueType()->metaType;
+    return d()->valueType()->metaType();
 }
 
 bool QQmlValueTypeWrapper::write(QObject *target, int propertyIndex) const
@@ -553,9 +553,9 @@ bool QQmlValueTypeWrapper::write(QObject *target, int propertyIndex) const
     Q_ALLOCA_DECLARE(void, gadget);
     if (d()->isReference()) {
         if (!d()->gadgetPtr()) {
-            Q_ALLOCA_ASSIGN(void, gadget, d()->valueType()->metaType.sizeOf());
+            Q_ALLOCA_ASSIGN(void, gadget, d()->valueType()->metaType().sizeOf());
             d()->setGadgetPtr(gadget);
-            d()->valueType()->metaType.construct(d()->gadgetPtr(), nullptr);
+            d()->valueType()->metaType().construct(d()->gadgetPtr(), nullptr);
             destructGadgetOnExit = true;
         }
         if (!readReferenceValue())
@@ -568,7 +568,7 @@ bool QQmlValueTypeWrapper::write(QObject *target, int propertyIndex) const
     QMetaObject::metacall(target, QMetaObject::WriteProperty, propertyIndex, a);
 
     if (destructGadgetOnExit) {
-        d()->valueType()->metaType.destruct(d()->gadgetPtr());
+        d()->valueType()->metaType().destruct(d()->gadgetPtr());
         d()->setGadgetPtr(nullptr);
     }
     return true;
@@ -605,9 +605,9 @@ ReturnedValue QQmlValueTypeWrapper::method_toString(const FunctionObject *b, con
         RETURN_UNDEFINED();
 
     QString result;
-    if (!QMetaType::convert(w->d()->valueType()->metaType, w->d()->gadgetPtr(),
+    if (!QMetaType::convert(w->d()->valueType()->metaType(), w->d()->gadgetPtr(),
                             QMetaType(QMetaType::QString), &result)) {
-        result = QString::fromUtf8(w->d()->valueType()->metaType.name()) + QLatin1Char('(');
+        result = QString::fromUtf8(w->d()->valueType()->metaType().name()) + QLatin1Char('(');
         const QMetaObject *mo = w->d()->metaObject();
         const int propCount = mo->propertyCount();
         for (int i = 0; i < propCount; ++i) {
diff --git a/src/qmlmodels/qqmladaptormodel.cpp b/src/qmlmodels/qqmladaptormodel.cpp
index aeabdcf22d..dd08f91c61 100644
--- a/src/qmlmodels/qqmladaptormodel.cpp
+++ b/src/qmlmodels/qqmladaptormodel.cpp
@@ -658,7 +658,7 @@ public:
             // NB: This acquires the lock on QQmlMetaTypeData. If we had a QQmlEngine here,
             //     we could use QQmlGadgetPtrWrapper::instance() to avoid this.
             if (const QQmlValueType *valueType = QQmlMetaType::valueType(type))
-                metaObject = valueType->metaObject();
+                metaObject = valueType->staticMetaObject();
             else
                 return QVariant();
         }