From dd39b4a61543da1a6ad66d0288702b0ea053388b Mon Sep 17 00:00:00 2001
From: Albert Astals Cid <albert.astals@canonical.com>
Date: Wed, 5 Apr 2017 11:57:45 +0200
Subject: [PATCH] Fix crash in QQuickPixmapReader & friends

In 9c50216c7bbbdb2bb51d4485286bf09e12fb5b62 I made the mistake
of not copying providerOptions inside QQuickPixmapReply as
is done for requestSize and url since i thought that i could
just use the data pointer to access it, but that's not possible since
data can get deleted in other thread so we need to copy
the value

Change-Id: Ie1d466b210108e1af1f0c8d3c618d4516448b73d
---
 src/quick/util/qquickpixmapcache.cpp | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/src/quick/util/qquickpixmapcache.cpp b/src/quick/util/qquickpixmapcache.cpp
index be27cba98..86a17ffb9 100644
--- a/src/quick/util/qquickpixmapcache.cpp
+++ b/src/quick/util/qquickpixmapcache.cpp
@@ -141,6 +141,7 @@ public:
     QUrl url;
 
     bool loading;
+    QQuickImageProviderOptions providerOptions;
     int redirectCount;
 
     class Event : public QEvent {
@@ -204,7 +205,7 @@ protected:
 private:
     friend class QQuickPixmapReaderThreadObject;
     void processJobs();
-    void processJob(QQuickPixmapReply *, const QUrl &, const QString &, const QQuickImageProviderOptions &, QQuickImageProvider::ImageType, QQuickImageProvider *);
+    void processJob(QQuickPixmapReply *, const QUrl &, const QString &, QQuickImageProvider::ImageType, QQuickImageProvider *);
 #if QT_CONFIG(qml_network)
     void networkRequestDone(QNetworkReply *);
 #endif
@@ -664,7 +665,7 @@ void QQuickPixmapReader::processJobs()
                     PIXMAP_PROFILE(pixmapStateChanged<QQuickProfiler::PixmapLoadingStarted>(url));
 
                     locker.unlock();
-                    processJob(job, url, localFile, job->data->providerOptions, imageType, provider);
+                    processJob(job, url, localFile, imageType, provider);
                     locker.relock();
                 }
             }
@@ -676,7 +677,6 @@ void QQuickPixmapReader::processJobs()
 }
 
 void QQuickPixmapReader::processJob(QQuickPixmapReply *runningJob, const QUrl &url, const QString &localFile,
-                                    const QQuickImageProviderOptions &providerOptions,
                                     QQuickImageProvider::ImageType imageType, QQuickImageProvider *provider)
 {
     // fetch
@@ -707,7 +707,7 @@ void QQuickPixmapReader::processJob(QQuickPixmapReply *runningJob, const QUrl &u
             {
                 QImage image;
                 if (providerV2) {
-                    image = providerV2->requestImage(imageId(url), &readSize, runningJob->requestSize, providerOptions);
+                    image = providerV2->requestImage(imageId(url), &readSize, runningJob->requestSize, runningJob->providerOptions);
                 } else {
                     image = provider->requestImage(imageId(url), &readSize, runningJob->requestSize);
                 }
@@ -728,7 +728,7 @@ void QQuickPixmapReader::processJob(QQuickPixmapReply *runningJob, const QUrl &u
             {
                 QPixmap pixmap;
                 if (providerV2) {
-                    pixmap = providerV2->requestPixmap(imageId(url), &readSize, runningJob->requestSize, providerOptions);
+                    pixmap = providerV2->requestPixmap(imageId(url), &readSize, runningJob->requestSize, runningJob->providerOptions);
                 } else {
                     pixmap = provider->requestPixmap(imageId(url), &readSize, runningJob->requestSize);
                 }
@@ -749,7 +749,7 @@ void QQuickPixmapReader::processJob(QQuickPixmapReply *runningJob, const QUrl &u
             {
                 QQuickTextureFactory *t;
                 if (providerV2) {
-                    t = providerV2->requestTexture(imageId(url), &readSize, runningJob->requestSize, providerOptions);
+                    t = providerV2->requestTexture(imageId(url), &readSize, runningJob->requestSize, runningJob->providerOptions);
                 } else {
                     t = provider->requestTexture(imageId(url), &readSize, runningJob->requestSize);
                 }
@@ -772,7 +772,7 @@ void QQuickPixmapReader::processJob(QQuickPixmapReply *runningJob, const QUrl &u
             {
                 QQuickImageResponse *response;
                 if (providerV2) {
-                    response = providerV2->requestImageResponse(imageId(url), runningJob->requestSize, providerOptions);
+                    response = providerV2->requestImageResponse(imageId(url), runningJob->requestSize, runningJob->providerOptions);
                 } else {
                     QQuickAsyncImageProvider *asyncProvider = static_cast<QQuickAsyncImageProvider*>(provider);
                     response = asyncProvider->requestImageResponse(imageId(url), runningJob->requestSize);
@@ -794,7 +794,7 @@ void QQuickPixmapReader::processJob(QQuickPixmapReply *runningJob, const QUrl &u
             QFile f(localFile);
             QSize readSize;
             if (f.open(QIODevice::ReadOnly)) {
-                if (!readImage(url, &f, &image, &errorStr, &readSize, runningJob->requestSize, providerOptions))
+                if (!readImage(url, &f, &image, &errorStr, &readSize, runningJob->requestSize, runningJob->providerOptions))
                     errorCode = QQuickPixmapReply::Loading;
             } else {
                 errorStr = QQuickPixmap::tr("Cannot open: %1").arg(url.toString());
@@ -1075,7 +1075,7 @@ void QQuickPixmap::purgeCache()
 }
 
 QQuickPixmapReply::QQuickPixmapReply(QQuickPixmapData *d)
-: data(d), engineForReader(0), requestSize(d->requestSize), url(d->url), loading(false), redirectCount(0)
+: data(d), engineForReader(0), requestSize(d->requestSize), url(d->url), loading(false), providerOptions(d->providerOptions), redirectCount(0)
 {
     if (finishedIndex == -1) {
         finishedIndex = QMetaMethod::fromSignal(&QQuickPixmapReply::finished).methodIndex();
-- 
2.12.1