QProperty: fix QBindingStoragePrivate::reallocate related code

In the internal hash map implementation, we have to ensure that the
index is in the interval [0, size - 1].
Moreover, in setBinding we have to refetch the binding storage in case a
reallocation happened.

Change-Id: I11c6264f16537699c8908b647e2355a39ce87648
Reviewed-by: Lars Knoll <lars.knoll@qt.io>

2 files changed, 5 insertions, 1 deletions

diff --git a/src/corelib/kernel/qproperty.cpp b/src/corelib/kernel/qproperty.cpp
index 81871587e8..4fdf0d8100 100644
--- a/src/corelib/kernel/qproperty.cpp
+++ b/src/corelib/kernel/qproperty.cpp
@@ -1388,7 +1388,8 @@ struct QBindingStoragePrivate
         for (size_t i = 0; i < d->size; ++i, ++p) {
             if (p->data) {
                 Pair *pp = pairs(newData);
-                size_t index = qHash(p->data);
+                Q_ASSERT(newData->size && (newData->size & (newData->size - 1)) == 0); // size is a power of two
+                size_t index = qHash(p->data) & (newData->size - 1);
                 while (pp[index].data) {
                     ++index;
                     if (index == newData->size)
diff --git a/src/corelib/kernel/qproperty_p.h b/src/corelib/kernel/qproperty_p.h
index 999760ec86..614756a670 100644
--- a/src/corelib/kernel/qproperty_p.h
+++ b/src/corelib/kernel/qproperty_p.h
@@ -397,6 +397,9 @@ public:
     {
         QtPrivate::QPropertyBindingData *bd = qGetBindingStorage(owner())->bindingData(this, true);
         QUntypedPropertyBinding oldBinding(bd->setBinding(newBinding, this, nullptr, bindingWrapper));
+        // refetch the binding data, as the eager evaluation in setBinding() above could cause a reallocation
+        // in the binding storage
+        bd = qGetBindingStorage(owner())->bindingData(this);
         notify(bd);
         return static_cast<QPropertyBinding<T> &>(oldBinding);
     }