Fix possible crash with top/bottom aligned images

An image inside at the end of a text block which did not start at text
position 0 would resolve to an invalid QTextLine, since we passed
the document position to lineForTextPosition(), which expects the
relative block position. If the image was aligned to top or
bottom, so that the extracted QTextLine was actually accessed,
this would cause a crash.

[ChangeLog][QtQuick][Text] Fixed a bug where aligning an image
to "top" or "bottom" could cause a crash under certain circumstances.

Task-number: QTBUG-77217
Change-Id: Iaa239ba482f2a765703656e4116cbebb8435a66e
Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>

4 files changed, 43 insertions, 1 deletions

diff --git a/src/quick/items/qquicktextnodeengine.cpp b/src/quick/items/qquicktextnodeengine.cpp
index 36fc168ec2..5a4ef2b686 100644
--- a/src/quick/items/qquicktextnodeengine.cpp
+++ b/src/quick/items/qquicktextnodeengine.cpp
@@ -477,7 +477,7 @@ void QQuickTextNodeEngine::addTextObject(const QTextBlock &block, const QPointF
         }
 
         qreal ascent;
-        QTextLine line = block.layout()->lineForTextPosition(pos);
+        QTextLine line = block.layout()->lineForTextPosition(pos - block.position());
         switch (format.verticalAlignment())
         {
         case QTextCharFormat::AlignTop:
diff --git a/tests/auto/quick/qquicktext/data/verticallyAlignedImageInTable.qml b/tests/auto/quick/qquicktext/data/verticallyAlignedImageInTable.qml
new file mode 100644
index 0000000000..4c00362d15
--- /dev/null
+++ b/tests/auto/quick/qquicktext/data/verticallyAlignedImageInTable.qml
@@ -0,0 +1,14 @@
+import QtQuick 2.0
+
+Item {
+    width: 320
+    height: 480
+
+    Text {
+        anchors.centerIn: parent
+        font.family: "Arial"
+        font.pixelSize: 16
+        textFormat: Text.RichText
+        text: "<table><tr><td/><td valign=\"top\"><img src=\"images/face-sad.png\"></td></tr></table>"
+    }
+}
diff --git a/tests/auto/quick/qquicktext/tst_qquicktext.cpp b/tests/auto/quick/qquicktext/tst_qquicktext.cpp
index a9c35e0cc4..eafa6cb052 100644
--- a/tests/auto/quick/qquicktext/tst_qquicktext.cpp
+++ b/tests/auto/quick/qquicktext/tst_qquicktext.cpp
@@ -161,6 +161,8 @@ private slots:
 
     void initialContentHeight();
 
+    void verticallyAlignedImageInTable();
+
 private:
     QStringList standard;
     QStringList richText;
@@ -4414,6 +4416,18 @@ void tst_qquicktext::implicitSizeChangeRewrap()
     QVERIFY(text->contentWidth() < window->width());
 }
 
+void tst_qquicktext::verticallyAlignedImageInTable()
+{
+    QScopedPointer<QQuickView> window(new QQuickView);
+    window->setSource(testFileUrl("verticallyAlignedImageInTable.qml"));
+    QTRY_COMPARE(window->status(), QQuickView::Ready);
+
+    window->show();
+    QVERIFY(QTest::qWaitForWindowExposed(window.data()));
+
+    // Don't crash
+}
+
 QTEST_MAIN(tst_qquicktext)
 
 #include "tst_qquicktext.moc"
diff --git a/tests/manual/scenegraph_lancelot/data/text/text_table_vertically_aligned_image.qml b/tests/manual/scenegraph_lancelot/data/text/text_table_vertically_aligned_image.qml
new file mode 100644
index 0000000000..d712f94572
--- /dev/null
+++ b/tests/manual/scenegraph_lancelot/data/text/text_table_vertically_aligned_image.qml
@@ -0,0 +1,14 @@
+import QtQuick 2.0
+
+Item {
+    width: 320
+    height: 480
+
+    Text {
+        anchors.centerIn: parent
+        font.family: "Arial"
+        font.pixelSize: 16
+        textFormat: Text.RichText
+        text: "<table><tr><td/><td valign=\"top\"><img src=\"data/logo.png\"></td></tr></table>"
+    }
+}