1 files changed, 36 insertions, 9 deletions

diff --git a/src/qml/qml/qqmlengine.cpp b/src/qml/qml/qqmlengine.cpp
index 70c682dedd..9c5e48ae32 100644
--- a/src/qml/qml/qqmlengine.cpp
+++ b/src/qml/qml/qqmlengine.cpp
@@ -258,6 +258,18 @@ void QQmlEnginePrivate::activateDesignerMode()
         on producing the image without blocking the main thread.
 */
 
+/*!
+    \fn QQmlImageProviderBase::imageType() const
+
+    Implement this method to return the image type supported by this image provider.
+*/
+
+/*!
+    \fn QQmlImageProviderBase::flags() const
+
+    Implement this to return the properties of this image provider.
+*/
+
 /*! \internal */
 QQmlImageProviderBase::QQmlImageProviderBase()
 {
@@ -1355,6 +1367,9 @@ QQmlEngine::ObjectOwnership QQmlEngine::objectOwnership(QObject *object)
         return ddata->indestructible?CppOwnership:JavaScriptOwnership;
 }
 
+/*!
+   \reimp
+*/
 bool QQmlEngine::event(QEvent *e)
 {
     Q_D(QQmlEngine);
@@ -1496,16 +1511,28 @@ QQmlDataExtended::~QQmlDataExtended()
 
 void QQmlData::NotifyList::layout(QQmlNotifierEndpoint *endpoint)
 {
-    if (endpoint->next)
-        layout(endpoint->next);
+    // Add a temporary sentinel at beginning of list. This will be overwritten
+    // when the end point is inserted into the notifies further down.
+    endpoint->prev = 0;
 
-    int index = endpoint->sourceSignal;
-    index = qMin(index, 0xFFFF - 1);
+    while (endpoint->next) {
+        Q_ASSERT(reinterpret_cast<QQmlNotifierEndpoint *>(endpoint->next->prev) == endpoint);
+        endpoint = endpoint->next;
+    }
+
+    while (endpoint) {
+        QQmlNotifierEndpoint *ep = (QQmlNotifierEndpoint *) endpoint->prev;
 
-    endpoint->next = notifies[index];
-    if (endpoint->next) endpoint->next->prev = &endpoint->next;
-    endpoint->prev = &notifies[index];
-    notifies[index] = endpoint;
+        int index = endpoint->sourceSignal;
+        index = qMin(index, 0xFFFF - 1);
+
+        endpoint->next = notifies[index];
+        if (endpoint->next) endpoint->next->prev = &endpoint->next;
+        endpoint->prev = &notifies[index];
+        notifies[index] = endpoint;
+
+        endpoint = ep;
+    }
 }
 
 void QQmlData::NotifyList::layout()
@@ -2182,7 +2209,7 @@ QObject *QQmlEnginePrivate::toQObject(const QVariant &v, bool *ok) const
     int t = v.userType();
     if (t == QMetaType::QObjectStar || m_compositeTypes.contains(t)) {
         if (ok) *ok = true;
-        return *(QObject **)(v.constData());
+        return *(QObject *const *)(v.constData());
     } else {
         return QQmlMetaType::toQObject(v, ok);
     }