QQuickIcon: Resolve source URL relative to outermost property owner

The original attempt, deb238586a "QQuickIcon: Resolve URL relative to
current element," works fine for IconLabel itself, but not for Buttons
containing IconLabel.

  // <style>/Button.qml
  T.Button {
      id: control
      icon:  // owner: control
      contentItem: IconLabel {
          icon: control.icon  // owner: this, but should be control
      }
  }

  // user code
  Button { icon.source: "a.png" }

Since IconLabel is an implementation detail of the Button, IconLabel.icon
owner needs to point to the Button so the user-specified icon.source can
be resolved relative to the user code, not to the <style>/ directory.

This patch fixes the problem by explicitly resolving the source URL on
setIcon() and propagating the resolved icon object to the inner items.
If the relative URL has already been resolved by e.g. Button, the inner
IconLabel never resolves the URL again to itself.

The problem could be addressed by initializing icon owner only once by
Action/Button constructor, but that would lead to dangling owner pointer
as icon object could be copied anywhere. So I've added resolvedSource
data member in place of the owner pointer.

  Button { id: dangling }
  Button { id: victim; icon: dangling.icon }  // owner: dangling
  Component.onCompleted: dangling.destroy()
  // ... would SEGV (or use after free) if victim.icon.source modified.

Fixes: QTBUG-95587
Pick-to: 6.2 6.3
Change-Id: Ibdd07118e79f1e1f36e1faea0289150eca734e27
Reviewed-by: Mitch Curtis <[email protected]>

1 files changed, 1 insertions, 1 deletions

diff --git a/src/quickcontrols2impl/qquickiconlabel.cpp b/src/quickcontrols2impl/qquickiconlabel.cpp
index a37ce02f6e..309a2c47d4 100644
--- a/src/quickcontrols2impl/qquickiconlabel.cpp
+++ b/src/quickcontrols2impl/qquickiconlabel.cpp
@@ -404,7 +404,7 @@ void QQuickIconLabel::setIcon(const QQuickIcon &icon)
         return;
 
     d->icon = icon;
-    d->icon.setOwner(this);
+    d->icon.ensureRelativeSourceResolved(this);
     d->updateOrSyncImage();
 }