QQuickSpriteEngine: avoid entering infinite loop in assembledImage()

Do not allow a frame size larger than the image size, otherwise
we would never leave "while (framesLeft > 0) {...}" as framesLeft is
never decremented because "copied/frameWidth" in the expression
"framesLeft -= copied/frameWidth;" always resolves to zero because
copied < frameWidth.

Task-number: QTBUG-53937
Change-Id: Ia777ec65d72562426b13533918efcaca5bcabdd7
Reviewed-by: Albert Astals Cid <albert.astals@canonical.com>
Reviewed-by: Shawn Rutledge <shawn.rutledge@qt.io>
Reviewed-by: Andy Nichols <andy.nichols@qt.io>

4 files changed, 85 insertions, 0 deletions

diff --git a/tests/auto/quick/qquickanimatedsprite/data/img100x100.png b/tests/auto/quick/qquickanimatedsprite/data/img100x100.png
new file mode 100644
index 0000000000..9dd1990780
--- /dev/null
+++ b/tests/auto/quick/qquickanimatedsprite/data/img100x100.png
diff --git a/tests/auto/quick/qquickanimatedsprite/data/img50x50.png b/tests/auto/quick/qquickanimatedsprite/data/img50x50.png
new file mode 100644
index 0000000000..5cbb47981a
--- /dev/null
+++ b/tests/auto/quick/qquickanimatedsprite/data/img50x50.png
diff --git a/tests/auto/quick/qquickanimatedsprite/data/sourceSwitch.qml b/tests/auto/quick/qquickanimatedsprite/data/sourceSwitch.qml
new file mode 100644
index 0000000000..18a8f52661
--- /dev/null
+++ b/tests/auto/quick/qquickanimatedsprite/data/sourceSwitch.qml
@@ -0,0 +1,46 @@
+/****************************************************************************
+**
+** Copyright (C) 2016 The Qt Company Ltd.
+** Contact: http://www.qt.io/licensing/
+**
+** This file is part of the test suite of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL21$
+** Commercial License Usage
+** Licensees holding valid commercial Qt licenses may use this file in
+** accordance with the commercial license agreement provided with the
+** Software or, alternatively, in accordance with the terms contained in
+** a written agreement between you and The Qt Company. For licensing terms
+** and conditions see http://www.qt.io/terms-conditions. For further
+** information use the contact form at http://www.qt.io/contact-us.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 or version 3 as published by the Free
+** Software Foundation and appearing in the file LICENSE.LGPLv21 and
+** LICENSE.LGPLv3 included in the packaging of this file. Please review the
+** following information to ensure the GNU Lesser General Public License
+** requirements will be met: https://www.gnu.org/licenses/lgpl.html and
+** http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** As a special exception, The Qt Company gives you certain additional
+** rights. These rights are described in The Qt Company LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+import QtQuick 2.4
+
+AnimatedSprite {
+    id: animatedSprite
+    source: big ? "img100x100.png" : "img50x50.png"
+    frameWidth: 100
+    frameHeight: 100
+    property bool big: true
+    MouseArea {
+        anchors.fill: parent
+        onClicked: animatedSprite.big = !animatedSprite.big
+    }
+}
diff --git a/tests/auto/quick/qquickanimatedsprite/tst_qquickanimatedsprite.cpp b/tests/auto/quick/qquickanimatedsprite/tst_qquickanimatedsprite.cpp
index 3cb7ff511f..b34ac63b83 100644
--- a/tests/auto/quick/qquickanimatedsprite/tst_qquickanimatedsprite.cpp
+++ b/tests/auto/quick/qquickanimatedsprite/tst_qquickanimatedsprite.cpp
@@ -40,6 +40,7 @@
 #include <QtGui/qopenglcontext.h>
 #include <QtGui/qopenglfunctions.h>
 #include <QtGui/qoffscreensurface.h>
+#include <QtQml/qqmlproperty.h>
 
 class tst_qquickanimatedsprite : public QQmlDataTest
 {
@@ -55,6 +56,7 @@ private slots:
     void test_largeAnimation_data();
     void test_largeAnimation();
     void test_reparenting();
+    void test_changeSourceToSmallerImgKeepingBigFrameSize();
 };
 
 void tst_qquickanimatedsprite::initTestCase()
@@ -291,6 +293,43 @@ void tst_qquickanimatedsprite::test_reparenting()
     QTRY_COMPARE(QQuickItemPrivate::get(sprite)->polishScheduled, false);
 }
 
+class KillerThread : public QThread
+{
+    Q_OBJECT
+protected:
+    void run() Q_DECL_OVERRIDE {
+        sleep(3);
+        qFatal("Either the GUI or the render thread is stuck in an infinite loop.");
+    }
+};
+
+// Regression test for QTBUG-53937
+void tst_qquickanimatedsprite::test_changeSourceToSmallerImgKeepingBigFrameSize()
+{
+    QQuickView window;
+    window.setSource(testFileUrl("sourceSwitch.qml"));
+    window.show();
+    QVERIFY(QTest::qWaitForWindowExposed(&window));
+
+    QVERIFY(window.rootObject());
+    QQuickAnimatedSprite* sprite = qobject_cast<QQuickAnimatedSprite*>(window.rootObject());
+    QVERIFY(sprite);
+
+    QQmlProperty big(sprite, "big");
+    big.write(QVariant::fromValue(false));
+
+    KillerThread *killer = new KillerThread;
+    killer->start(); // will kill us in case the GUI or render thread enters an infinite loop
+
+    QTest::qWait(50); // let it draw with the new source.
+
+    // If we reach this point it's because we didn't hit QTBUG-53937
+
+    killer->terminate();
+    killer->wait();
+    delete killer;
+}
+
 QTEST_MAIN(tst_qquickanimatedsprite)
 
 #include "tst_qquickanimatedsprite.moc"