Make sure the sqrt value in qdrawhelper is non-negative

It's possible for the "det" variable to exceed 0 and be negative.
This scenario is already handled in one case, this change will fix second case.

Pick-to: 6.7
Fixes: QTBUG-120907
Change-Id: Ib30213b3455b5c6f3b8b8384e78e7b43158f93b5
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

1 files changed, 10 insertions, 1 deletions

diff --git a/src/gui/painting/qdrawhelper.cpp b/src/gui/painting/qdrawhelper.cpp
index 5fe0a5b41b..301e430b11 100644
--- a/src/gui/painting/qdrawhelper.cpp
+++ b/src/gui/painting/qdrawhelper.cpp
@@ -3255,6 +3255,7 @@ public:
     static Type null() { return 0; }
     static Type fetchSingle(const QGradientData& gradient, qreal v)
     {
+        Q_ASSERT(std::isfinite(v));
         return qt_gradient_pixel(&gradient, v);
     }
     static Type fetchSingle(const QGradientData& gradient, int v)
@@ -3275,6 +3276,7 @@ public:
     static Type null() { return QRgba64::fromRgba64(0); }
     static Type fetchSingle(const QGradientData& gradient, qreal v)
     {
+        Q_ASSERT(std::isfinite(v));
         return qt_gradient_pixel64(&gradient, v);
     }
     static Type fetchSingle(const QGradientData& gradient, int v)
@@ -3296,6 +3298,7 @@ public:
     static Type null() { return QRgbaFloat32::fromRgba64(0,0,0,0); }
     static Type fetchSingle(const QGradientData& gradient, qreal v)
     {
+        Q_ASSERT(std::isfinite(v));
         return qt_gradient_pixelFP(&gradient, v);
     }
     static Type fetchSingle(const QGradientData& gradient, int v)
@@ -3445,7 +3448,13 @@ public:
             }
         } else {
             while (buffer < end) {
-                *buffer++ = GradientBase::fetchSingle(data->gradient, qSqrt(det) - b);
+                BlendType result = GradientBase::null();
+                if (det >= 0) {
+                    qreal w = qSqrt(det) - b;
+                    result = GradientBase::fetchSingle(data->gradient, w);
+                }
+
+                *buffer++ = result;
 
                 det += delta_det;
                 delta_det += delta_delta_det;