Fix crash in distance field cache with some glyphs

The size of a distance field for a glyph is calculated
as:

  w = ceil((boundingRect.width() + 2 * margin) / scale)
  h = ceil((boundingRect.height() + 2 * margin) / scale)

In addition, the RHI-specific cache subclass adds
padding on the outside of this.

This was done in multiple places, both in Qt Base and
Qt Declarative. If they got out of sync, then we would
crash, since the distance field size is expected to
match up with the allocated rect in the cache's
texture.

For the most part this worked since the formula was
copied everywhere, but since the QDistanceField does
a translate() on the path before getting the bounding
rect, we could get a result which was off by a very
small amount (0.0000000000000071 in this case). A
qCeil() turned this into an off-by-one, and memory
corruption occurred.

To avoid duplicating this formula in both Qt Base
and Qt Declarative, we explicitly pass in the size
we expect when creating the QDistanceField.

Pick-to: 6.7 6.5 6.2 5.15
Fixes: QTBUG-124572
Change-Id: I6bb8ab4db17b43fe8ddf9db35de5b7d51ccb54de
Reviewed-by: Eirik Aavitsland <[email protected]>
(cherry picked from commit 2370cb0)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>

Author: eskilblomfeldt

src/quick/scenegraph/qsgadaptationlayer.cpp

@@ -166,7 +166,12 @@ void QSGDistanceFieldGlyphCache::update()
     distanceFields.reserve(pendingGlyphsSize);
     for (int i = 0; i < pendingGlyphsSize; ++i) {
         GlyphData &gd = glyphData(m_pendingGlyphs.at(i));
-        distanceFields.append(QDistanceField(gd.path,
+
+        QSize size = QSize(qCeil(gd.texCoord.width + gd.texCoord.xMargin * 2),
+                           qCeil(gd.texCoord.height + gd.texCoord.yMargin * 2));
+
+        distanceFields.append(QDistanceField(size,
+                                             gd.path,
                                              m_pendingGlyphs.at(i),
                                              m_doubleGlyphResolution));
         gd.path = QPainterPath(); // no longer needed, so release memory used by the painter path