Fix crash in OpenVG when failing to allocate large VGImages.

The reclaimSpace() function of the VG image pool was crashing when
attempting to free up space for a large image. It was calling
moveToHeadOfLRU() which adds the image to the pool. If the pixmap is
large enough so that it pushes all the others out, then it will be the
only pixmap left in the pool when this function returns. This is
problematic because this pixmap is not permanent so it could be
deleted. If that happens, then subsequent calls to this function will
crash because the LRU pixmap has been deleted.

The fix is to check if the pixmap was in the pool to begin with and
if not, then be sure to remove it before returning from this function.

Task-number: QT-3652
Reviewed-by: Jani Hautakangas

1 files changed, 10 insertions, 3 deletions

diff --git a/src/openvg/qvgimagepool.cpp b/src/openvg/qvgimagepool.cpp
index 78277aa..0c236ea 100644
--- a/src/openvg/qvgimagepool.cpp
+++ b/src/openvg/qvgimagepool.cpp
@@ -154,16 +154,23 @@ bool QVGImagePool::reclaimSpace(VGImageFormat format,
     Q_UNUSED(width);
     Q_UNUSED(height);
 
-    if (data)
+    bool succeeded = false;
+    bool wasInLRU = false;
+    if (data) {
+        wasInLRU = data->inLRU;
         moveToHeadOfLRU(data);
+    }
 
     QVGPixmapData *lrudata = pixmapLRU();
     if (lrudata && lrudata != data) {
         lrudata->reclaimImages();
-        return true;
+        succeeded = true;
     }
 
-    return false;
+    if (data && !wasInLRU)
+        removeFromLRU(data);
+
+    return succeeded;
 }
 
 void QVGImagePool::hibernate()