[qt/qt/qtbase]: Summary of bulk changes made

Git repository change summary for qt/qt/qtbase
Pushed by mirror-service into branch '6.11'.
Changed from 0c8c6bce2c0b3a7e51c0be9b25f2c971b39daef1 to 6fd904d0307e21dfd3635feb1a8d5f6efc3e33d6
Acknowledgement was received that this change introduces only existing code that has been pushed to another public open source repository.

This change contains the following new commits:

Git commit 31474ac76dbb4a3208e4d49433c723909b25d4cc by Qt Cherry-pick Bot (on behalf of Marc Mutz) on 07/08/2026 at 11:53..
QDomBuilder: fix Coverity RESOURCE_LEAK False Positive

Coverity is not very clever when analyzing unique_ptr uses. It seems
to assume that get() is never an ownership-transfer and release()
always is. It is therefore not surprising that it complains about the
discarded release() return value.

The issue is a bit more subtle, though, because appendChild() _can_
fail to adopt, in which case the code _would_ leak the proposed
child. What makes this an FP is that none of the conditions that would
prevent appendChild() from adopting hold here: In Claude AI's words:

> `n` and `e` are freshly-created, parentless, non-fragment nodes
> appended with refChild == nullptr. In QDomNodePrivate::insertAfter()
> [called by appendChild()—Ed.] every return preceding
> newChild->ref.ref() requires a null/fragment newChild or a foreign
> refChild — none possible here — so ownership is always taken. With
> exceptions disabled appendChild has no other exit, hence no path
> leaks.

A minimal solution would therefore be to release() into
appendChild(). We know from experience that this would silence
Coverity (cf. e.g. a868c236b77077c5587485988287c123178a2a10). But
using unique_ptr here feels wrong, because, at a conceptual level,
we're dealing with ref-counted objects here and unique_ptr assumes
unique ownership.

So the correct fix would be to port the whole module to use QESDP
instead of raw ref()/deref(), but that may never happen, seeing as
QtXml is "done".

But we can use QESDP locally in characters() to make the code more
robust and easier to understand for humans and Coverity alike. We just
need to get the ref-counts right:

Observe that QDomNodePrivate objects start out with a ref == 1.

For 'n', the createX() factory functions unconditionally deref their
return value, so they come out as ref == 0. The old code left the
ref-count alone. In the new code, QESDP::reset() increases the
ref-count, and ~QESDP decreases. So if appendChild() didn't adopt for
some reasons, ~QESDP will reap the child, otherwise it's a no-op.

For 'e', the old code deref'ed in characters() directly, so here, too,
the ref-count was 0 going into appendChild(). In the new code, the
QESDP QAdopt ctor leaves the ref-count at 1, the manual deref is gone,
and QESDP::reset() following appendChild() reaps the child iff
appendChild() didn't adopt.

Add a small factory function to mirror make_unique() for QESDP. We
should have something like this in QtCore, but I don't want to add in
this unrelated commit.

Amends the start of the public history.

Pick-to: 6.8
Coverity-Id: 390131
Change-Id: Ia6ab9daf6e7518b051b43f39659638a8587bd29a
Reviewed-by: Ivan Solovev <[email protected]>
(cherry picked from commit ef537a5395faf82bf944c4a416e5bea8e19abf9d)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
(cherry picked from commit 9049bc85e72b98e98989276bf91b953a52584dbc)
https://invent.kde.org/qt/qt/qtbase/-/commit/31474ac76dbb4a3208e4d49433c723909b25d4cc

Git commit 439142eaf9cbbe2d2d9e3a136f96d4022f97748c by Qt Cherry-pick Bot (on behalf of Eskil Abrahamsen Blomfeldt) on 07/08/2026 at 11:53..
Upgrade Harfbuzz to 14.3.0

[ChangeLog][Third-Party Code] Upgraded Harfbuzz to version 14.3.0

Pick-to: 6.8 6.5 5.15
Task-number: QTBUG-148737
Change-Id: I7718b39359c63d865ba60e6548c05884b1d727bc
Reviewed-by: Christian Strømme <[email protected]>
(cherry picked from commit b36b1d43a5e9323db30594bf8423f7a686dd96d2)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
(cherry picked from commit 9d6eb4c7146a9d9f82668853fc7f79960691ac9f)
https://invent.kde.org/qt/qt/qtbase/-/commit/439142eaf9cbbe2d2d9e3a136f96d4022f97748c

Git commit 84e9d2e620e854ec122fb6443c6574e2a00d7d70 by Qt Cherry-pick Bot (on behalf of Marc Mutz) on 07/08/2026 at 11:53..
QWindowsShellItem: replace stack with heap buffer in copyData()

The buffer size of ~100KiB represents ~10% of total default Windows
stack size, and was flagged by a MinGW built when attempting to build
QtBase using -Wframe-larger-than=20KiB.

Replace the stack buffer with a heap one. This also fixes the problem
that, post 9ff1e6d80bbd5b44b9ec4c0a837d9a4c962698e4, those 100KiB
would have likely been pattern-init'ed by -ftrivial-auto-var-init
before the first Read().

Amends 5865e582fd537fff530c13301e5229a7b4ed21c7 (5.9).

Pick-to: 6.8
Change-Id: I0402cdc2a0f4abf58814b5eaff6a97fb29ceb82b
Reviewed-by: Oliver Wolff <[email protected]>
(cherry picked from commit 9e4095c4d2323907b75b99e9410fde33ba10e745)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
(cherry picked from commit 95685d029d55486bddd2f0d10cae162723742ff4)
https://invent.kde.org/qt/qt/qtbase/-/commit/84e9d2e620e854ec122fb6443c6574e2a00d7d70

Git commit 226f1b7ee5c2d1f9b7bbbba0f7ed10a35abd5805 by Qt Cherry-pick Bot (on behalf of Marc Mutz) on 07/08/2026 at 11:53..
tst_QSequentialAnimationGroup: fix memleak in noIntegerOverflow()

The old code removeAnimation(a2)'ed, but then didn't delete that
de-parented, heap-allocated object `a2`, causing asan to record a
leak.

Fix by a manual delete. The more robust way would be to allocate these
TestAnimations on the stack, as is done elsewhere in the class, but
that would cause more code churn. The animation is owned by a
stack-allocated object until removeAnimation(), so this won't leak
even in a failure case, and thus there's no need to churn the code.

Amends 9d103def6fcf1fee2d81a16cf4c81717afe2b818 (picked to 5.15).

Pick-to: 6.8 6.5 5.15
Change-Id: Ieea54165871deb58dc91eff6280584ec819fad36
Reviewed-by: Ivan Solovev <[email protected]>
(cherry picked from commit 7fbf36b3b64c2884374a1a608e497f2055499fa0)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
(cherry picked from commit 4bdf308dc3db87d6a4b73d31b2bbee290b2db8bb)
https://invent.kde.org/qt/qt/qtbase/-/commit/226f1b7ee5c2d1f9b7bbbba0f7ed10a35abd5805

Git commit 6fd904d0307e21dfd3635feb1a8d5f6efc3e33d6 by Qt Cherry-pick Bot (on behalf of Eskil Abrahamsen Blomfeldt) on 07/08/2026 at 11:53..
Upgrade md4c to 0.5.3

[ChangeLog][Third-Party Code] Upgraded md4c to version 0.5.3.

Task-number: QTBUG-148738
Pick-to: 6.8 6.5
Change-Id: Ic29906e0ea05940f50a8368d3b4f3a4abb2430ee
Reviewed-by: Christian Strømme <[email protected]>
(cherry picked from commit c61c12a53f0aabb7ff0e4131125e638041ad8f40)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
(cherry picked from commit e1af090f42cafe6b7968b4d1a2ad499eaf834ff3)
https://invent.kde.org/qt/qt/qtbase/-/commit/6fd904d0307e21dfd3635feb1a8d5f6efc3e33d6