Fix crash when trying to place toolbar into zero-height window.

Change QToolBarAreaLayout::item() to return a pointer
and check return values in plug().

Task-number: QTBUG-37183
Change-Id: I7029eb9739cbe603460e87d3e5493f116bdb3a89
Reviewed-by: J-P Nurmi <jpnurmi@digia.com>
(cherry picked from qtbase/e38ad9455099a83e2a8619f19ca949bc64ae6f82)

3 files changed, 32 insertions, 20 deletions

diff --git a/src/gui/widgets/qmainwindowlayout.cpp b/src/gui/widgets/qmainwindowlayout.cpp
index fc52057..bb63b4f 100644
--- a/src/gui/widgets/qmainwindowlayout.cpp
+++ b/src/gui/widgets/qmainwindowlayout.cpp
@@ -510,8 +510,11 @@ QLayoutItem *QMainWindowLayoutState::item(const QList<int> &path)
     int i = path.first();
 
 #ifndef QT_NO_TOOLBAR
-    if (i == 0)
-        return toolBarAreaLayout.item(path.mid(1)).widgetItem;
+    if (i == 0) {
+        const QToolBarAreaLayoutItem *tbItem = toolBarAreaLayout.item(path.mid(1));
+        Q_ASSERT(tbItem);
+        return tbItem->widgetItem;
+    }
 #endif
 
 #ifndef QT_NO_DOCKWIDGET
@@ -1580,9 +1583,10 @@ bool QMainWindowLayout::plug(QLayoutItem *widgetItem)
 
     QList<int> previousPath = layoutState.indexOf(widget);
 
-    QLayoutItem *it = layoutState.plug(currentGapPos);
+    const QLayoutItem *it = layoutState.plug(currentGapPos);
+    if (!it)
+        return false;
     Q_ASSERT(it == widgetItem);
-    Q_UNUSED(it);
     if (!previousPath.isEmpty())
         layoutState.remove(previousPath);
 
diff --git a/src/gui/widgets/qtoolbararealayout.cpp b/src/gui/widgets/qtoolbararealayout.cpp
index be09949..ae99e7f 100644
--- a/src/gui/widgets/qtoolbararealayout.cpp
+++ b/src/gui/widgets/qtoolbararealayout.cpp
@@ -1106,16 +1106,19 @@ void QToolBarAreaLayout::clear()
     rect = QRect();
 }
 
-QToolBarAreaLayoutItem &QToolBarAreaLayout::item(const QList<int> &path)
+QToolBarAreaLayoutItem *QToolBarAreaLayout::item(const QList<int> &path)
 {
     Q_ASSERT(path.count() == 3);
 
-    Q_ASSERT(path.at(0) >= 0 && path.at(0) < QInternal::DockCount);
+    if (path.at(0) < 0 || path.at(0) >= QInternal::DockCount)
+        return 0;
     QToolBarAreaLayoutInfo &info = docks[path.at(0)];
-    Q_ASSERT(path.at(1) >= 0 && path.at(1) < info.lines.count());
+    if (path.at(1) < 0 || path.at(1) >= info.lines.count())
+        return 0;
     QToolBarAreaLayoutLine &line = info.lines[path.at(1)];
-    Q_ASSERT(path.at(2) >= 0 && path.at(2) < line.toolBarItems.count());
-    return line.toolBarItems[path.at(2)];
+    if (path.at(2) < 0 || path.at(2) >= line.toolBarItems.count())
+        return 0;
+    return &(line.toolBarItems[path.at(2)]);
 }
 
 QRect QToolBarAreaLayout::itemRect(const QList<int> &path) const
@@ -1131,23 +1134,28 @@ QRect QToolBarAreaLayout::itemRect(const QList<int> &path) const
 
 QLayoutItem *QToolBarAreaLayout::plug(const QList<int> &path)
 {
-    QToolBarAreaLayoutItem &item = this->item(path);
-    Q_ASSERT(item.gap);
-    Q_ASSERT(item.widgetItem != 0);
-    item.gap = false;
-    return item.widgetItem;
+    QToolBarAreaLayoutItem *item = this->item(path);
+    if (!item) {
+        qWarning() << Q_FUNC_INFO << "No item at" << path;
+        return 0;
+    }
+    Q_ASSERT(item->gap);
+    Q_ASSERT(item->widgetItem != 0);
+    item->gap = false;
+    return item->widgetItem;
 }
 
 QLayoutItem *QToolBarAreaLayout::unplug(const QList<int> &path, QToolBarAreaLayout *other)
 {
     //other needs to be update as well
     Q_ASSERT(path.count() == 3);
-    QToolBarAreaLayoutItem &item = this->item(path);
+    QToolBarAreaLayoutItem *item = this->item(path);
+    Q_ASSERT(item);
 
     //update the leading space here
     QToolBarAreaLayoutInfo &info = docks[path.at(0)];
     QToolBarAreaLayoutLine &line = info.lines[path.at(1)];
-    if (item.size != pick(line.o, item.realSizeHint())) {
+    if (item->size != pick(line.o, item->realSizeHint())) {
         //the item doesn't have its default size
         //so we'll give this to the next item
         int newExtraSpace = 0;
@@ -1184,9 +1192,9 @@ QLayoutItem *QToolBarAreaLayout::unplug(const QList<int> &path, QToolBarAreaLayo
         }
     }
 
-    Q_ASSERT(!item.gap);
-    item.gap = true;
-    return item.widgetItem;
+    Q_ASSERT(!item->gap);
+    item->gap = true;
+    return item->widgetItem;
 }
 
 static QRect unpackRect(uint geom0, uint geom1, bool *floating)
diff --git a/src/gui/widgets/qtoolbararealayout_p.h b/src/gui/widgets/qtoolbararealayout_p.h
index a5d27eb..0cffc70 100644
--- a/src/gui/widgets/qtoolbararealayout_p.h
+++ b/src/gui/widgets/qtoolbararealayout_p.h
@@ -232,7 +232,7 @@ public:
     void remove(const QList<int> &path);
     void remove(QLayoutItem *item);
     void clear();
-    QToolBarAreaLayoutItem &item(const QList<int> &path);
+    QToolBarAreaLayoutItem *item(const QList<int> &path);
     QRect itemRect(const QList<int> &path) const;
     QLayoutItem *plug(const QList<int> &path);
     QLayoutItem *unplug(const QList<int> &path, QToolBarAreaLayout *other);