Fix Translator::resolveDuplicates()

The method was relying on undefined behavior by assuming that
the references to the items inside the list of messages did not
change even though entries were removed from the list.

Fix this by only remembering the duplicate indices and removing them
all in one go at the end.

Fixes: QTBUG-86507
Change-Id: I41995961945d513fe793b2cea99b78334e3c7425
Reviewed-by: Andrei Golubev <andrei.golubev@qt.io>
Reviewed-by: Kai Koehne <kai.koehne@qt.io>

1 files changed, 8 insertions, 3 deletions

diff --git a/src/linguist/shared/translator.cpp b/src/linguist/shared/translator.cpp
index a2ea32a13..50dc7f8cc 100644
--- a/src/linguist/shared/translator.cpp
+++ b/src/linguist/shared/translator.cpp
@@ -568,10 +568,11 @@ inline bool operator==(TranslatorMessageContentPtr tmp1, TranslatorMessageConten
 
 Translator::Duplicates Translator::resolveDuplicates()
 {
+    QList<int> duplicateIndices;
     Duplicates dups;
     QHash<TranslatorMessageIdPtr, int> idRefs;
     QHash<TranslatorMessageContentPtr, int> contentRefs;
-    for (int i = 0; i < m_messages.count();) {
+    for (int i = 0; i < m_messages.count(); ++i) {
         const TranslatorMessage &msg = m_messages.at(i);
         TranslatorMessage *omsg;
         int oi;
@@ -606,15 +607,19 @@ Translator::Duplicates Translator::resolveDuplicates()
         if (!msg.id().isEmpty())
             idRefs[TranslatorMessageIdPtr(msg)] = i;
         contentRefs[TranslatorMessageContentPtr(msg)] = i;
-        ++i;
         continue;
       gotDupe:
         pDup->insert(oi);
         if (!omsg->isTranslated() && msg.isTranslated())
             omsg->setTranslations(msg.translations());
         m_indexOk = false;
-        m_messages.removeAt(i);
+        // don't remove the duplicate entries yet to not mess up the pointers that
+        // are in the hashes
+        duplicateIndices.append(i);
     }
+    // now remove the duplicates from the messages
+    for (int i = duplicateIndices.size() - 1; i >= 0; --i)
+        m_messages.removeAt(duplicateIndices.at(i));
     return dups;
 }