QML: Before processing deep aliases, remove pending bindings

We may have additional bindings scheduled for the deep alias, but those
are to be overridden by the alias. They should therefore be removed like
bindings to target properties of shallow aliases.

For QProperty bindings we have to apply a separate trick and set and
clear the binding bit in the right places. We don't have access to the
actual binding when writing the value, after all.

Pick-to: 6.6 6.5 6.2
Fixes: QTBUG-115579
Change-Id: Ia915e59905d7e3185a17c5b6613926264ad9bc6b
Reviewed-by: Qt CI Bot <qt_ci_bot@qt-project.org>
Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>

2 files changed, 36 insertions, 12 deletions

diff --git a/src/qml/qml/qqmlobjectcreator.cpp b/src/qml/qml/qqmlobjectcreator.cpp
index dc4f25c22d..3ecca952da 100644
--- a/src/qml/qml/qqmlobjectcreator.cpp
+++ b/src/qml/qml/qqmlobjectcreator.cpp
@@ -909,10 +909,13 @@ bool QQmlObjectCreator::setPropertyBinding(const QQmlPropertyData *bindingProper
             && !(bindingFlags & QV4::CompiledData::Binding::IsPropertyObserver)
             && !_valueTypeProperty;
 
-    if (_ddata->hasBindingBit(bindingProperty->coreIndex()) && allowedToRemoveBinding) {
-        QQmlPropertyPrivate::removeBinding(_bindingTarget, QQmlPropertyIndex(bindingProperty->coreIndex()));
-    } else if (bindingProperty->isBindable() && allowedToRemoveBinding) {
-        removePendingBinding(_bindingTarget, bindingProperty->coreIndex());
+    if (allowedToRemoveBinding) {
+        if (bindingProperty->isBindable()) {
+            removePendingBinding(_bindingTarget, bindingProperty->coreIndex());
+        } else {
+            QQmlPropertyPrivate::removeBinding(
+                    _bindingTarget, QQmlPropertyIndex(bindingProperty->coreIndex()));
+        }
     }
 
     if (bindingType == QV4::CompiledData::Binding::Type_Script || binding->isTranslationBinding()) {
@@ -958,6 +961,9 @@ bool QQmlObjectCreator::setPropertyBinding(const QQmlPropertyData *bindingProper
                 qmlBinding = QQmlPropertyBinding::create(bindingProperty, runtimeFunction, _scopeObject, context, currentQmlContext(), _bindingTarget, index);
             }
             sharedState.data()->allQPropertyBindings.push_back(DeferredQPropertyBinding {_bindingTarget, bindingProperty->coreIndex(), qmlBinding });
+
+            QQmlData *data = QQmlData::get(_bindingTarget, true);
+            data->setBindingBit(_bindingTarget, bindingProperty->coreIndex());
         } else {
             // When writing bindings to grouped properties implemented as value types,
             // such as point.x: { someExpression; }, then the binding is installed on
@@ -1469,6 +1475,14 @@ bool QQmlObjectCreator::finalize(QQmlInstantiationInterrupt &interrupt)
 
     while (!sharedState->allQPropertyBindings.isEmpty()) {
         auto& [target, index, qmlBinding] = sharedState->allQPropertyBindings.first();
+
+        QQmlData *data = QQmlData::get(target);
+        if (!data || !data->hasBindingBit(index)) {
+            // The target property has been overwritten since we stashed the binding.
+            sharedState->allQPropertyBindings.pop_front();
+            continue;
+        }
+
         QUntypedBindable bindable;
         void *argv[] = { &bindable };
         // allow interception
diff --git a/src/qml/qml/qqmlvmemetaobject.cpp b/src/qml/qml/qqmlvmemetaobject.cpp
index 8d524e2e5d..6259b6c315 100644
--- a/src/qml/qml/qqmlvmemetaobject.cpp
+++ b/src/qml/qml/qqmlvmemetaobject.cpp
@@ -1059,15 +1059,20 @@ int QQmlVMEMetaObject::metaCall(QObject *o, QMetaObject::Call c, int _id, void *
                 int coreIndex = encodedIndex.coreIndex();
                 const int valueTypePropertyIndex = encodedIndex.valueTypeIndex();
 
-                // Remove binding (if any) on write
-                if(c == QMetaObject::WriteProperty) {
-                    int flags = *reinterpret_cast<int*>(a[3]);
-                    if (flags & QQmlPropertyData::RemoveBindingOnAliasWrite) {
-                        QQmlData *targetData = QQmlData::get(target);
-                        if (targetData && targetData->hasBindingBit(coreIndex))
-                            QQmlPropertyPrivate::removeBinding(target, encodedIndex);
+                const auto removePendingBinding
+                        = [c, a](QObject *target, int coreIndex, QQmlPropertyIndex encodedIndex) {
+                    // Remove binding (if any) on write
+                    if (c == QMetaObject::WriteProperty) {
+                        int flags = *reinterpret_cast<int*>(a[3]);
+                        if (flags & QQmlPropertyData::RemoveBindingOnAliasWrite) {
+                            QQmlData *targetData = QQmlData::get(target);
+                            if (targetData && targetData->hasBindingBit(coreIndex)) {
+                                QQmlPropertyPrivate::removeBinding(target, encodedIndex);
+                                targetData->clearBindingBit(coreIndex);
+                            }
+                        }
                     }
-                }
+                };
 
                 if (valueTypePropertyIndex != -1) {
                     if (!targetDData->propertyCache)
@@ -1077,6 +1082,7 @@ int QQmlVMEMetaObject::metaCall(QObject *o, QMetaObject::Call c, int _id, void *
                     QQmlGadgetPtrWrapper *valueType = QQmlGadgetPtrWrapper::instance(
                                 ctxt->engine(), pd->propType());
                     if (valueType) {
+                        removePendingBinding(target, coreIndex, encodedIndex);
                         valueType->read(target, coreIndex);
                         int rv = QMetaObject::metacall(valueType, c, valueTypePropertyIndex, a);
 
@@ -1089,10 +1095,14 @@ int QQmlVMEMetaObject::metaCall(QObject *o, QMetaObject::Call c, int _id, void *
                         // deep alias
                         void *argv[1] = { &target };
                         QMetaObject::metacall(target, QMetaObject::ReadProperty, coreIndex, argv);
+                        removePendingBinding(
+                                target, valueTypePropertyIndex,
+                                QQmlPropertyIndex(valueTypePropertyIndex));
                         return QMetaObject::metacall(target, c, valueTypePropertyIndex, a);
                     }
 
                 } else {
+                    removePendingBinding(target, coreIndex, encodedIndex);
                     return QMetaObject::metacall(target, c, coreIndex, a);
                 }