[qt/qt/qtbase]: Summary of bulk changes made

Git repository change summary for qt/qt/qtbase
Pushed by mirror-service into branch '6.12'.
Changed from ea582c547a52377c8e58223ae8560876e29f55a0 to 4390e7a17c37e83f39d04fe3efddbf5a0f690737
Acknowledgement was received that this change introduces only existing code that has been pushed to another public open source repository.

This change contains the following new commits:

Git commit fc248bc3c005c01501d027c77a44b3afe0ff821e by Qt Cherry-pick Bot (on behalf of Tim Blechmann) on 07/08/2026 at 04:24..
QThread: increase threshold for CreateWaitableTimerEx

`QThread::sleep` uses `CreateWaitableTimerEx` instead of `Sleep` for
short sleep durations. This allows much shorter sleep durations, though
the threshold is very low: 2ms.
By default the `Sleep` resolution is tied to the clock ticks, of 1/64s,
i.e 15.6ms. By increasing the threshold for `CreateWaitableTimerEx` to
twice the `Sleep` granularity should reduce the make sleeps between 2
and 30ms more precise.

Task-number: QTBUG-148838
Change-Id: I37a0a70c89469b9ff7161622e6697fcb8a37122d
Reviewed-by: Thiago Macieira <[email protected]>
Reviewed-by: Mårten Nordheim <[email protected]>
(cherry picked from commit e94fe59a53085e276f11fb96f18b62e8058f50ef)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/fc248bc3c005c01501d027c77a44b3afe0ff821e

Git commit e1af090f42cafe6b7968b4d1a2ad499eaf834ff3 by Qt Cherry-pick Bot (on behalf of Eskil Abrahamsen Blomfeldt) on 07/08/2026 at 08:24..
Upgrade md4c to 0.5.3

[ChangeLog][Third-Party Code] Upgraded md4c to version 0.5.3.

Task-number: QTBUG-148738
Pick-to: 6.11 6.8 6.5
Change-Id: Ic29906e0ea05940f50a8368d3b4f3a4abb2430ee
Reviewed-by: Christian Strømme <[email protected]>
(cherry picked from commit c61c12a53f0aabb7ff0e4131125e638041ad8f40)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/e1af090f42cafe6b7968b4d1a2ad499eaf834ff3

Git commit 9d6eb4c7146a9d9f82668853fc7f79960691ac9f by Qt Cherry-pick Bot (on behalf of Eskil Abrahamsen Blomfeldt) on 07/08/2026 at 08:24..
Upgrade Harfbuzz to 14.3.0

[ChangeLog][Third-Party Code] Upgraded Harfbuzz to version 14.3.0

Pick-to: 6.11 6.8 6.5 5.15
Task-number: QTBUG-148737
Change-Id: I7718b39359c63d865ba60e6548c05884b1d727bc
Reviewed-by: Christian Strømme <[email protected]>
(cherry picked from commit b36b1d43a5e9323db30594bf8423f7a686dd96d2)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/9d6eb4c7146a9d9f82668853fc7f79960691ac9f

Git commit ec02738a2f8edea9b578c4ed914f575d47d54b61 by Qt Cherry-pick Bot (on behalf of Magdalena Stojek) on 07/08/2026 at 08:24..
QDom: Guard against null nodes returned by factory functions

Since the default InvalidDataPolicy changed to ReturnNullNode, the
QDomDocumentPrivate factory functions return nullptr when the input
contains data that is invalid per XML 1.0. QDomBuilder::characters(),
QDomBuilder::skippedEntity() and QDomBuilder::comment() used the
returned node without checking, causing a crash.

Check for nullptr and return false, as startElement() and
processingInstruction() already do.

Fixes: QTBUG-148791
Change-Id: Id46c8438e648008d7edad50ae411d682ec5152f6
Reviewed-by: Thiago Macieira <[email protected]>
(cherry picked from commit 8b5670485050cbedffe92c9ca48537f89dc896bd)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/ec02738a2f8edea9b578c4ed914f575d47d54b61

Git commit 6d449b2143eeae47efa9e0ce5077a6ab4c61012c by Qt Cherry-pick Bot (on behalf of André Klitzing) on 07/08/2026 at 08:24..
Add logging for entitlements files of macdeployqt

That information is missing in logfile but it is
important for debugging codesign issues.

Change-Id: I3dfd59d377cc8c3e89004fe2d9a77043f2b7df27
Reviewed-by: Tor Arne Vestbø <[email protected]>
(cherry picked from commit 8b3654cb64ca59f531867ef04352eab059f48973)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/6d449b2143eeae47efa9e0ce5077a6ab4c61012c

Git commit 9049bc85e72b98e98989276bf91b953a52584dbc by Qt Cherry-pick Bot (on behalf of Marc Mutz) on 07/08/2026 at 08:24..
QDomBuilder: fix Coverity RESOURCE_LEAK False Positive

Coverity is not very clever when analyzing unique_ptr uses. It seems
to assume that get() is never an ownership-transfer and release()
always is. It is therefore not surprising that it complains about the
discarded release() return value.

The issue is a bit more subtle, though, because appendChild() _can_
fail to adopt, in which case the code _would_ leak the proposed
child. What makes this an FP is that none of the conditions that would
prevent appendChild() from adopting hold here: In Claude AI's words:

> `n` and `e` are freshly-created, parentless, non-fragment nodes
> appended with refChild == nullptr. In QDomNodePrivate::insertAfter()
> [called by appendChild()—Ed.] every return preceding
> newChild->ref.ref() requires a null/fragment newChild or a foreign
> refChild — none possible here — so ownership is always taken. With
> exceptions disabled appendChild has no other exit, hence no path
> leaks.

A minimal solution would therefore be to release() into
appendChild(). We know from experience that this would silence
Coverity (cf. e.g. a868c236b77077c5587485988287c123178a2a10). But
using unique_ptr here feels wrong, because, at a conceptual level,
we're dealing with ref-counted objects here and unique_ptr assumes
unique ownership.

So the correct fix would be to port the whole module to use QESDP
instead of raw ref()/deref(), but that may never happen, seeing as
QtXml is "done".

But we can use QESDP locally in characters() to make the code more
robust and easier to understand for humans and Coverity alike. We just
need to get the ref-counts right:

Observe that QDomNodePrivate objects start out with a ref == 1.

For 'n', the createX() factory functions unconditionally deref their
return value, so they come out as ref == 0. The old code left the
ref-count alone. In the new code, QESDP::reset() increases the
ref-count, and ~QESDP decreases. So if appendChild() didn't adopt for
some reasons, ~QESDP will reap the child, otherwise it's a no-op.

For 'e', the old code deref'ed in characters() directly, so here, too,
the ref-count was 0 going into appendChild(). In the new code, the
QESDP QAdopt ctor leaves the ref-count at 1, the manual deref is gone,
and QESDP::reset() following appendChild() reaps the child iff
appendChild() didn't adopt.

Add a small factory function to mirror make_unique() for QESDP. We
should have something like this in QtCore, but I don't want to add in
this unrelated commit.

Amends the start of the public history.

Pick-to: 6.11 6.8
Coverity-Id: 390131
Change-Id: Ia6ab9daf6e7518b051b43f39659638a8587bd29a
Reviewed-by: Ivan Solovev <[email protected]>
(cherry picked from commit ef537a5395faf82bf944c4a416e5bea8e19abf9d)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/9049bc85e72b98e98989276bf91b953a52584dbc

Git commit 95685d029d55486bddd2f0d10cae162723742ff4 by Qt Cherry-pick Bot (on behalf of Marc Mutz) on 07/08/2026 at 08:24..
QWindowsShellItem: replace stack with heap buffer in copyData()

The buffer size of ~100KiB represents ~10% of total default Windows
stack size, and was flagged by a MinGW built when attempting to build
QtBase using -Wframe-larger-than=20KiB.

Replace the stack buffer with a heap one. This also fixes the problem
that, post 9ff1e6d80bbd5b44b9ec4c0a837d9a4c962698e4, those 100KiB
would have likely been pattern-init'ed by -ftrivial-auto-var-init
before the first Read().

Amends 5865e582fd537fff530c13301e5229a7b4ed21c7 (5.9).

Pick-to: 6.11 6.8
Change-Id: I0402cdc2a0f4abf58814b5eaff6a97fb29ceb82b
Reviewed-by: Oliver Wolff <[email protected]>
(cherry picked from commit 9e4095c4d2323907b75b99e9410fde33ba10e745)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/95685d029d55486bddd2f0d10cae162723742ff4

Git commit 4bdf308dc3db87d6a4b73d31b2bbee290b2db8bb by Qt Cherry-pick Bot (on behalf of Marc Mutz) on 07/08/2026 at 08:24..
tst_QSequentialAnimationGroup: fix memleak in noIntegerOverflow()

The old code removeAnimation(a2)'ed, but then didn't delete that
de-parented, heap-allocated object `a2`, causing asan to record a
leak.

Fix by a manual delete. The more robust way would be to allocate these
TestAnimations on the stack, as is done elsewhere in the class, but
that would cause more code churn. The animation is owned by a
stack-allocated object until removeAnimation(), so this won't leak
even in a failure case, and thus there's no need to churn the code.

Amends 9d103def6fcf1fee2d81a16cf4c81717afe2b818 (picked to 5.15).

Pick-to: 6.11 6.8 6.5 5.15
Change-Id: Ieea54165871deb58dc91eff6280584ec819fad36
Reviewed-by: Ivan Solovev <[email protected]>
(cherry picked from commit 7fbf36b3b64c2884374a1a608e497f2055499fa0)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/4bdf308dc3db87d6a4b73d31b2bbee290b2db8bb

Git commit 11532126ce4965ced8c8ad9a340f44e174899660 by Qt Cherry-pick Bot (on behalf of Sol ZHu) on 07/08/2026 at 08:24..
ohos: fix crash when handling IME cursor movement

The OHOS input context constructed QChar objects from Qt arrow-key
values when processing an IME cursor-movement callback. These special
key values exceed the UTF-16 range and trigger a QChar assertion in
debug builds.

Change the functional-key helper to accept QString text. Pass empty text
for arrow keys, since navigation keys do not generate Unicode text, and
preserve the control-character text for Delete, Backspace, and Enter
using QStringLiteral.

This prevents crashes when an input method moves the cursor, such as
after inserting paired Chinese punctuation.

Task-number: QTBUG-148419
Change-Id: Ifb528fa8b2c136be95e2edd20f69b6fc1331d803
Reviewed-by: Zbigniew Chyla <[email protected]>
Reviewed-by: Seokha Ko <[email protected]>
Reviewed-by: Liang Qi <[email protected]>
(cherry picked from commit 3199e593aa230f63f154d47592083171b5ea3522)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/11532126ce4965ced8c8ad9a340f44e174899660

Git commit 7777c16bcfd1ce1c7761d40f02ac47aaf7bc0ae5 by Qt Cherry-pick Bot (on behalf of Tor Arne Vestbø) on 07/08/2026 at 08:24..
iOS: Default to the host architecture for simulator builds

When configuring Qt with -sdk iphonesimulator we would always pick
x86_64 as the target architecture, even on an Apple silicon host,
where the simulator runs arm64 binaries. Default to the host
architecture instead.

[ChangeLog][iOS] Qt builds for the iOS simulator SDK now default to
the host architecture, instead of always defaulting to x86_64.

Change-Id: Ic540b7880f02cb053b4aa10e0285f54a7c57a3e6
Reviewed-by: Ece Cinucen <[email protected]>
Reviewed-by: Doris Verria <[email protected]>
(cherry picked from commit bc18089b3ec2397123230b448d448ac13c3585a0)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/7777c16bcfd1ce1c7761d40f02ac47aaf7bc0ae5

Git commit 4390e7a17c37e83f39d04fe3efddbf5a0f690737 by Qt Cherry-pick Bot (on behalf of Tor Arne Vestbø) on 07/08/2026 at 08:24..
QLibraryInfo: Only report app paths first when a qt.conf says so

QLibraryInfo serves two use cases that want different answers from the
same call: "where does the Qt I run against live", which is what Qt's
own tools ask, and "where are my own resources", which is what an
application asks. As path() reports the first path only, whichever
prefix we report first decides who gets the wrong answer.

The bundle-aware work reported the application-prefixed paths first, for
any bundled application, and for any application with a qt.conf. Qt
Designer then started looking for the Assistant binary inside its own
bundle, and a development build of a bundled application, before its
qt.conf is in place, lost track of the Qt it was built against. In a Qt
Creator built from source that is its QML import path, the qmlls binary,
the qsb binary used to bake Effect Composer shaders, and its
translations.

We now report the paths a qt.conf lists explicitly first, as they are
the only ones anyone declared, and group the rest by the prefix they are
rooted at, letting the qt.conf decide which group comes first. A
user-written qt.conf keeps its long-standing exclusivity: the
application declares the layout it follows, and we report nothing of the
Qt build. Without one the Qt paths come first, followed by the paths the
application's own layout implies, so that both are available to the
plugin and QML module lookups we do via paths() ourselves.

A qt.conf that merges with the Qt build defaults is not a description of
the application's layout, but an overlay generated by Qt QML's build
machinery, and contributes only the locations it lists. That is what the
MergeQtConf marker meant before we dropped it in
3dff7f394454a992c42ba54154d2b6dae0a81481, on the assumption that an
extra application-rooted entry no one configured is harmless. It is not,
as the paths are consumed via path() rather than as a list of candidate
locations.

Being a bundle is not a statement about where Qt content was deployed
either, so a bundle on its own now only implies the modern Apple
suffixes, which is what the deployment machinery populates. The Unixy
suffixes at the application prefix are back to requiring a qt.conf, as
they did before this series, and a bundle that deploys Qt into itself
still reports them via the Qt prefix.

Task-number: QTBUG-148751
Change-Id: I0bbd056185cdcc19fe7b30e13fce523881a727dc
Reviewed-by: Fabian Kosmale <[email protected]>
(cherry picked from commit b299ec64b12e002fa8b2173dee82b2fe91cdf6bf)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/4390e7a17c37e83f39d04fe3efddbf5a0f690737