Crash in QWidget::render when passing an untransformed QPixmap painter.

The crash only occurred on Windows and X11 when running with
-graphicssystem raster. The reason is that the actual paint device
in QRasterPaintEngine::begin() is changed to pixmap->data->buffer(),
which means QPaintEngine::paintDevice() returns something else than
what it was told to paint on (see cb0c899b56b84154f69ddc545991bc6ded96ab01)

The root of the problem, however, was that we used a weird condition
(painter->worldMatrixEnabled(), added in 345072b9 for Qt 4.4) to find
the target device. We did that because the shared painter was completely
different in 4.4. We refactored it in 4.5.0, and we can only trust
QPaintEngine::paintDevice to be the target device.

Auto-test included.

Task-number: 252837
Reviewed-by: Trond

2 files changed, 12 insertions, 1 deletions

diff --git a/src/gui/kernel/qwidget.cpp b/src/gui/kernel/qwidget.cpp
index fb9c8cb9e5..b96d8b3bb9 100644
--- a/src/gui/kernel/qwidget.cpp
+++ b/src/gui/kernel/qwidget.cpp
@@ -4805,7 +4805,7 @@ void QWidget::render(QPainter *painter, const QPoint &targetOffset,
     Q_ASSERT(engine);
     QPaintEnginePrivate *enginePriv = engine->d_func();
     Q_ASSERT(enginePriv);
-    QPaintDevice *target = painter->worldMatrixEnabled() ? engine->paintDevice() : painter->device();
+    QPaintDevice *target = engine->paintDevice();
     Q_ASSERT(target);
 
     // Render via a pixmap when dealing with non-opaque painters or printers.
diff --git a/tests/auto/qwidget/tst_qwidget.cpp b/tests/auto/qwidget/tst_qwidget.cpp
index dee48a3f1c..5896df9f0d 100644
--- a/tests/auto/qwidget/tst_qwidget.cpp
+++ b/tests/auto/qwidget/tst_qwidget.cpp
@@ -287,6 +287,7 @@ private slots:
     void render_systemClip2();
     void render_systemClip3_data();
     void render_systemClip3();
+    void render_task252837();
 
     void setContentsMargins();
 
@@ -7097,6 +7098,16 @@ void tst_QWidget::render_systemClip3()
     }
 }
 
+void tst_QWidget::render_task252837()
+{
+    QWidget widget;
+    widget.resize(200, 200);
+
+    QPixmap pixmap(widget.size());
+    QPainter painter(&pixmap);
+    // Please do not crash.
+    widget.render(&painter);
+}
 void tst_QWidget::setContentsMargins()
 {
     QLabel label("why does it always rain on me?");