Fix crash for multiscript text in QTextEngine::boundingBox()

The logClusters pointer is already adjusted for the item, so it should
be indexed relative to the item, hence from 0 to itemLength-1. Adding
pos to the index would give us a random value for all script items > 0.
Thus this would sometimes crash for text that spanned several scripts,
since we would sometimes get a value back which was outside the bounds
of the glyph array.

Task-number: QTBUG-9374
Reviewed-by: Samuel

1 files changed, 1 insertions, 1 deletions

diff --git a/src/gui/text/qtextengine.cpp b/src/gui/text/qtextengine.cpp
index b826588..eaa80d3 100644
--- a/src/gui/text/qtextengine.cpp
+++ b/src/gui/text/qtextengine.cpp
@@ -1648,7 +1648,7 @@ glyph_metrics_t QTextEngine::boundingBox(int from,  int len) const
                 }
             }
 
-            glyph_t glyph = glyphs.glyphs[logClusters[pos + ilen - 1]];
+            glyph_t glyph = glyphs.glyphs[logClusters[ilen - 1]];
             glyph_metrics_t gi = fe->boundingBox(glyph);
             if (gi.isValid())
                 gm.width -= qRound(gi.xoff - gi.x - gi.width);