Qml: Fix crash by function definition in grouped property, reject it

Before, 'Text { font { function func() {}}}' would crash because of the
data inconsistency. A function defined inside a grouped property is
pushed to _object->declarationsOverride->functions, whereas its compiled
expression goes to _object->functionsAndExpressions. And later,
QmlUnitGenerator::generate() iterates over "functions" and reads
runtimeFunctionIndices[i], which is built from "functionsAndExpressions".

Suppose this would be probably broken since the introduction of the
functionsAndExpressions at 963875db26, and it's super confusing that
a grouped property can declare anything into the ancestor object context,
this patch disables a function declaration in a grouped property.

Change-Id: I1d5ecf2f01afc902f43f4ef6c6f5454cedbd0766
Reviewed-by: Qt CI Bot <qt_ci_bot@qt-project.org>
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>

1 files changed, 13 insertions, 4 deletions

diff --git a/src/qml/compiler/qqmlirbuilder.cpp b/src/qml/compiler/qqmlirbuilder.cpp
index 00eabf2bc5..51c28f5c39 100644
--- a/src/qml/compiler/qqmlirbuilder.cpp
+++ b/src/qml/compiler/qqmlirbuilder.cpp
@@ -265,10 +265,11 @@ QString Object::appendAlias(Alias *alias, const QString &aliasName, bool isDefau
 
 void Object::appendFunction(QmlIR::Function *f)
 {
-    Object *target = declarationsOverride;
-    if (!target)
-        target = this;
-    target->functions->append(f);
+    // Unlike properties, a function definition inside a grouped property does not go into
+    // the surrounding object. It's been broken since the Qt 5 era, and the semantics
+    // seems super confusing, so it wouldn't make sense to support that.
+    Q_ASSERT(!declarationsOverride);
+    functions->append(f);
 }
 
 void Object::appendInlineComponent(InlineComponent *ic)
@@ -1011,6 +1012,14 @@ bool IRBuilder::visit(QQmlJS::AST::UiPublicMember *node)
 bool IRBuilder::visit(QQmlJS::AST::UiSourceElement *node)
 {
     if (QQmlJS::AST::FunctionExpression *funDecl = node->sourceElement->asFunctionDefinition()) {
+        if (_object->declarationsOverride) {
+            // See Object::appendFunction() for why.
+            recordError(node->firstSourceLocation(),
+                        QCoreApplication::translate(
+                                "QQmlParser", "Function declaration inside grouped property"));
+            return false;
+        }
+
         CompiledFunctionOrExpression *foe = New<CompiledFunctionOrExpression>();
         foe->node = funDecl;
         foe->parentNode = funDecl;