From dfc6dc1d94a729f701172861a196b4b34bcd7518 Mon Sep 17 00:00:00 2001
From: Eskil Abrahamsen Blomfeldt <eskil.abrahamsen-blomfeldt@qt.io>
Date: Tue, 30 Jul 2019 14:14:50 +0200
Subject: Fix possible crash with top/bottom aligned images

An image inside at the end of a text block which did not start at text
position 0 would resolve to an invalid QTextLine, since we passed
the document position to lineForTextPosition(), which expects the
relative block position. If the image was aligned to top or
bottom, so that the extracted QTextLine was actually accessed,
this would cause a crash.

[ChangeLog][QtQuick][Text] Fixed a bug where aligning an image
to "top" or "bottom" could cause a crash under certain circumstances.

Task-number: QTBUG-77217
Change-Id: Iaa239ba482f2a765703656e4116cbebb8435a66e
Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
---
 .../qquicktext/data/verticallyAlignedImageInTable.qml      | 14 ++++++++++++++
 tests/auto/quick/qquicktext/tst_qquicktext.cpp             | 14 ++++++++++++++
 .../data/text/text_table_vertically_aligned_image.qml      | 14 ++++++++++++++
 3 files changed, 42 insertions(+)
 create mode 100644 tests/auto/quick/qquicktext/data/verticallyAlignedImageInTable.qml
 create mode 100644 tests/manual/scenegraph_lancelot/data/text/text_table_vertically_aligned_image.qml

(limited to 'tests')

diff --git a/tests/auto/quick/qquicktext/data/verticallyAlignedImageInTable.qml b/tests/auto/quick/qquicktext/data/verticallyAlignedImageInTable.qml
new file mode 100644
index 0000000000..4c00362d15
--- /dev/null
+++ b/tests/auto/quick/qquicktext/data/verticallyAlignedImageInTable.qml
@@ -0,0 +1,14 @@
+import QtQuick 2.0
+
+Item {
+    width: 320
+    height: 480
+
+    Text {
+        anchors.centerIn: parent
+        font.family: "Arial"
+        font.pixelSize: 16
+        textFormat: Text.RichText
+        text: "<table><tr><td/><td valign=\"top\"><img src=\"images/face-sad.png\"></td></tr></table>"
+    }
+}
diff --git a/tests/auto/quick/qquicktext/tst_qquicktext.cpp b/tests/auto/quick/qquicktext/tst_qquicktext.cpp
index a9c35e0cc4..eafa6cb052 100644
--- a/tests/auto/quick/qquicktext/tst_qquicktext.cpp
+++ b/tests/auto/quick/qquicktext/tst_qquicktext.cpp
@@ -161,6 +161,8 @@ private slots:
 
     void initialContentHeight();
 
+    void verticallyAlignedImageInTable();
+
 private:
     QStringList standard;
     QStringList richText;
@@ -4414,6 +4416,18 @@ void tst_qquicktext::implicitSizeChangeRewrap()
     QVERIFY(text->contentWidth() < window->width());
 }
 
+void tst_qquicktext::verticallyAlignedImageInTable()
+{
+    QScopedPointer<QQuickView> window(new QQuickView);
+    window->setSource(testFileUrl("verticallyAlignedImageInTable.qml"));
+    QTRY_COMPARE(window->status(), QQuickView::Ready);
+
+    window->show();
+    QVERIFY(QTest::qWaitForWindowExposed(window.data()));
+
+    // Don't crash
+}
+
 QTEST_MAIN(tst_qquicktext)
 
 #include "tst_qquicktext.moc"
diff --git a/tests/manual/scenegraph_lancelot/data/text/text_table_vertically_aligned_image.qml b/tests/manual/scenegraph_lancelot/data/text/text_table_vertically_aligned_image.qml
new file mode 100644
index 0000000000..d712f94572
--- /dev/null
+++ b/tests/manual/scenegraph_lancelot/data/text/text_table_vertically_aligned_image.qml
@@ -0,0 +1,14 @@
+import QtQuick 2.0
+
+Item {
+    width: 320
+    height: 480
+
+    Text {
+        anchors.centerIn: parent
+        font.family: "Arial"
+        font.pixelSize: 16
+        textFormat: Text.RichText
+        text: "<table><tr><td/><td valign=\"top\"><img src=\"data/logo.png\"></td></tr></table>"
+    }
+}
-- 
cgit v1.2.3