[qt/qt/qtbase]: Summary of bulk changes made

Git repository change summary for qt/qt/qtbase
Pushed by mirror-service into branch '6.12'.
Changed from 4390e7a17c37e83f39d04fe3efddbf5a0f690737 to a0c828d4b44b4b87eb9130c2f16c73c77dc1aa1c
Acknowledgement was received that this change introduces only existing code that has been pushed to another public open source repository.

This change contains the following new commits:

Git commit 88b9c6c117185c6323dac2393ac8a2ab3418c321 by Qt Cherry-pick Bot (on behalf of Laszlo Agocs) on 07/08/2026 at 11:53..
Do not dereference a null extension name in QEGLPlatformContext

In case glGetStringi() returns null for some reason. Some other
platforms, notably Windows and xcb with GLX already check for
this.

Pick-to: 6.11 6.8
Change-Id: I016e06488a3e194470ab84cae692c0fe9788771e
Reviewed-by: Andy Nichols <[email protected]>
(cherry picked from commit 1f16a2db66f80b51f75db005be1962063087ee52)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/88b9c6c117185c6323dac2393ac8a2ab3418c321

Git commit bcbb05d4f770ccff98d7ddad335a9e9b478d643c by Qt Cherry-pick Bot (on behalf of Laszlo Agocs) on 07/08/2026 at 11:53..
Keep the OpenGL shader cache in the application-specific location

The program binary cache preferred QStandardPaths::GenericCacheLocation
and only fell back to the application-specific CacheLocation when the
shared directory was not writable. The generic location has no
organization or application name in it, so in practice every Qt
application run by the same user shared one directory.

Change it to always use CacheLocation. The cost is that applications no
longer share compiled binaries with each other, so each one compiles its
own set on first run, which only ever mattered for applications using
byte identical shaders. This mitigates the unlikely case of tainting the
program binaries with modified versions that then get loaded and
executed by an unrelated application running as the same user.

[ChangeLog][QtGui][OpenGL] The OpenGL program binaries are now stored in
the application-specific cache location, not the generic (shared) one,
in order to alleviate security concerns. This change is not applicable
when using Qt Quick, since the modern QRhi-based program/pipeline cache
mechanism in Qt Quick has always used the per-application cache
location. This patch makes the legacy OpenGL program binary cache, and
so applications that directly use APIs such as QOpenGLShaderProgram,
behave similarly.

Task-number: QTBUG-148741
Change-Id: I21ab0a4e46e71d671f62777ecedf65dcc9d6529b
Reviewed-by: Andy Nichols <[email protected]>
(cherry picked from commit 293d6a5984cf6242d280d2d6b93b84637f674693)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/bcbb05d4f770ccff98d7ddad335a9e9b478d643c

Git commit 753dbb7518018ab879a856673e5306d00f73e0d6 by Qt Cherry-pick Bot (on behalf of Laszlo Agocs) on 07/08/2026 at 11:53..
Gracefully handle broken VK_EXT_debug_utils

Fixes: QTBUG-148216
Pick-to: 6.11 6.8
Change-Id: I16180bb5b9a5bda9eb6b99167ecd61b5410ce07c
Reviewed-by: Andy Nichols <[email protected]>
(cherry picked from commit 73d38519db4e0bb8815b44ce59ead3e35de67858)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/753dbb7518018ab879a856673e5306d00f73e0d6

Git commit fd37894c1e120a36335af048278a5d865d6c10ac by Qt Cherry-pick Bot (on behalf of Laszlo Agocs) on 07/08/2026 at 11:53..
Bounds check the OpenGL program binary cache file parsing

Past the 16 byte base header, load() consumed the cache file with no
reference to how much of it there actually was. readStr() took a 32-bit
length straight out of the file and advanced the cursor by it, and the
blob size was passed unvalidated to glProgramBinary() and to the
QByteArray that backs the in-memory cache. A file truncated after the
header therefore read off the end, and a file with a large enough size
field made the driver and the copy read far beyond the mapping.

Replace the two unchecked helpers with a cursor that knows where the
file ends and fails instead of running past it, and reject a blob that
is larger than what is left. Also reject sizes above INT_MAX, since both
GLsizei and QByteArray are signed, and widen the MemCacheEntry size
parameter from int for the same reason.

Note that on Unix the file is mmap'ed, so while the mapSize is now
checked, a concurrent truncation can still raise SIGBUS regardless
of these checks.

Task-number: QTBUG-148743
Pick-to: 6.11 6.8
Change-Id: I4b3733aa214834f8d7da8fe1db39cb23155edb03
Reviewed-by: Andy Nichols <[email protected]>
(cherry picked from commit 6ed66a8583f357e31a8d9de949a31b1a27c9c3b5)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/fd37894c1e120a36335af048278a5d865d6c10ac

Git commit 42fa50147f00f5d92bd9aac3919c8436be18a09c by Qt Cherry-pick Bot (on behalf of Laszlo Agocs) on 07/08/2026 at 11:53..
Fix tst_qrhi to not die with MoltenVK on macOS

Not a fully supported setup to run QRhi autotests on Vulkan
on MoltenVK, but it should not end up crashing instead of
reporting failures.

Change-Id: I8efe706f13cd0521c0f1384c18f1f8f4ab96ad30
Reviewed-by: Andy Nichols <[email protected]>
(cherry picked from commit a790b40b46aac8e6e6d030648ba70944406aa084)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/42fa50147f00f5d92bd9aac3919c8436be18a09c

Git commit 6f1165a817577b4dbdafaba81c9d39536f5f58e8 by Qt Cherry-pick Bot (on behalf of Laszlo Agocs) on 07/08/2026 at 11:53..
rhi: Clamp texture uploads to the raw data actually provided

On the raw data upload path neither sourceSize() nor dataStride() was
checked against data().size(), and unlike the QImage path there was no
destination clamp either. An oversized size or stride therefore produced
a copy command reaching past the bytes that were staged.

Add clampedSubResourceUploadSizeForSourceData(), the source side
counterpart of the existing clampedSubResourceUploadSize(), and apply
both clamps in all five backends. The clamp requires
(height - 1) * stride + width * bytesPerPixel bytes: a stride pads only
between rows, so the trailing padding of the last row is not counted.
That matches the Vulkan and OpenGL rules for addressing a copy region,
while with D3D12 the staging copy is performed row by row by ourselves.
However, whether the last row's padding is read cannot be guaranteed
for D3D11 (UpdateSubresource) and Metal, because the behavior is not
clearly specified for these. Therefore, expand the setDataStride()
documentation to state that the data is expected to include the
trailing padding of the last row as well.

Also add an autotest.

This does not change the fact that the QRhi API should be used with
trusted content only, but gracefully handling incorrect size or stride
arguments and unintentionally truncated image data is something we
should still do.

Change-Id: Ieb9efc5835b94dd819cc886e160e44e7a174d1f3
Reviewed-by: Andy Nichols <[email protected]>
(cherry picked from commit 2ca8063ff5430cf225bf2a259b32e946cf7f1ed3)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/6f1165a817577b4dbdafaba81c9d39536f5f58e8

Git commit 1d3d211122045d763eb639ac409165c7ec9a55f9 by Qt Cherry-pick Bot (on behalf of Laszlo Agocs) on 07/08/2026 at 11:53..
rhi: d3d: Do derefAdapter while the LUID is still valid

Calling the function after adapterLuid is nulled out is clearly
not ideal.

Task-number: QTBUG-148834
Pick-to: 6.11 6.8
Change-Id: I16e3118fe700ec628e3da5557d101092dff03f13
Reviewed-by: Andy Nichols <[email protected]>
(cherry picked from commit deb8dcad67418210d5cc2104a97cb8cb9fd66e5e)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/1d3d211122045d763eb639ac409165c7ec9a55f9

Git commit ab7b38e1fe878e2339ad172701a97e903d4719d3 by Qt Cherry-pick Bot (on behalf of Ivan Solovev) on 07/08/2026 at 11:53..
QDebug: make NSString streaming operator a hidden friend

We prefer the approach with hidden friends in the new code because it
relies on ADL and avoids polluting the global namespace.

Amends 194cb0b736b75ed06ce309208f1e1f2ede07732f.

Found in 6.12 API review.

Change-Id: I2555447b7ee05cfaff8632d130c77b2bff8425e7
Reviewed-by: Tim Blechmann <[email protected]>
Reviewed-by: Thiago Macieira <[email protected]>
Reviewed-by: Tor Arne Vestbø <[email protected]>
(cherry picked from commit 576b084dc245d5ef119e739bc90885927f8721ad)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/ab7b38e1fe878e2339ad172701a97e903d4719d3

Git commit 9cfc1bb2d611192b0d38c4de800284756a31c091 by Qt Cherry-pick Bot (on behalf of Ivan Solovev) on 07/08/2026 at 11:53..
QSaveFile: do not add overrides of permissions()/setPermissions()

In the application compiled with the old version of Qt, the compiler
could de-virtualize the call to (set)Permissions(), because it could
see that there're no QSaveFile overrides of the methods. Similarly,
user-provided subclasses of QSaveFile could provide their custom
implementations that are directly calling the base methods from
QFileDevice.
That all would result in the new overloads being a no-op.

Instead, add new virtual methods to QFileDevicePrivate, call them
from the base public virtual methods, and provide overlaods in
QSaveFilePrivate. We also need to call QFileDevicePrivate's base
implementations in QSaveFile when we want to explicitly bypass
the virtual dispatch.

The patch keeps the overrides in QSaveFile under #ifdef Q_QDOC
because we still want to keep the docs for the QSaveFile's
implementation.

Amends a64a75f340d79c9a9ec55f1c73471e3b47ca59bf.

Found in 6.12 API review.

Change-Id: I57c17efde27b5cb091d712e16f9643600f75cc67
Reviewed-by: Edward Welbourne <[email protected]>
Reviewed-by: Volker Hilsheimer <[email protected]>
(cherry picked from commit 706718a3749ea0dc2eadf998b14195c0d017e9ef)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/9cfc1bb2d611192b0d38c4de800284756a31c091

Git commit f68f3473f71cb2559e8196d893e4fe9669c41044 by Qt Cherry-pick Bot (on behalf of Ivan Solovev) on 07/08/2026 at 11:53..
QTimeZone/tz: fix fallback to the legacy zoneinfo directory

Due to a copy-paste error, the code was never actually falling back
to using the legacy /usr/lib/zoneinfo path.

Fix by using the proper variable.

This is a regression caused by 569dc0de50a46b64763921199a2706ab34d151a9.

The original patch was picked down to 6.5, but this is not a security
issue, so not suitable for ESM branches.

Pick-to: 6.11 6.8
Change-Id: I06f3d742a495c9ed21d1a433e1ab73a3c075b8e1
Reviewed-by: Edward Welbourne <[email protected]>
(cherry picked from commit 9859bfe7042481d5a0e024aabde722abdeb1d12b)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/f68f3473f71cb2559e8196d893e4fe9669c41044

Git commit bdbd0e22e5b47d2a31ac943981708a0588fcb0db by Qt Cherry-pick Bot (on behalf of Paul Olav Tvete) on 07/08/2026 at 11:53..
FreeType: Skip bitmap decode for metrics-only glyph loads

When available, use FT_LOAD_BITMAP_METRICS_ONLY for fetching
metrics to avoid decoding the same bitmap data multiple times
when only the glyph metrics are queried.

This can improve the rendering performance of individual emojis by
4000%.

Pick-to: 6.11 6.8
Change-Id: I3b256356cee63fc04495861e6ac78e98d2629b6d
Reviewed-by: Paul Olav Tvete <[email protected]>
Reviewed-by: Eskil Abrahamsen Blomfeldt <[email protected]>
(cherry picked from commit 4a3747ce2a48d2e5e8e9c903a1cd54018045db18)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/bdbd0e22e5b47d2a31ac943981708a0588fcb0db

Git commit 3000ce3824265d3074326e00bd45f2f9f54d925e by Qt Cherry-pick Bot (on behalf of Arkadiusz Zarębski) on 07/08/2026 at 11:53..
ohos: Provide IME left/right text-of-cursor

Reason for the change:
Huawei tested text entry on the English keyboard and found that
repeatedly typing 'a' produced "AaaAAA..." in the editor. The defect is
the unexpected switch to uppercase 'A'. The expected output is
"Aaaaaa...".

The input method's auto-capitalization relies on reading the text around
the cursor to decide letter case. Without the left/right text-of-cursor
callbacks the input method could not obtain this context and
intermittently re-applied capitalization.

Fix:
Implement OH_TextEditorProxy_SetGetLeftTextOfCursorFunc and
OH_TextEditorProxy_SetGetRightTextOfCursorFunc (executed on a worker
thread). The text before and after the cursor is computed on the Qt GUI
thread (QOhosInputContext::update()) and pushed into a thread-safe
member  (QOhosMutexProtectedValue) owned by the input method proxy.

Task-number: QTBUG-148511
Change-Id: I2d2483a979c41551db980221178c11cf2d82684e
Reviewed-by: Zbigniew Chyla <[email protected]>
Reviewed-by: Liang Qi <[email protected]>
(cherry picked from commit 994c8c28c525f5c8cf7194acbfdfa9e927531094)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/3000ce3824265d3074326e00bd45f2f9f54d925e

Git commit 49ddc8a0d232b9bd48fc6e149fb33848f87f0254 by Qt Cherry-pick Bot (on behalf of Aleksander Wawrzyniak) on 07/08/2026 at 11:53..
harmonyos: Remove commented out include

This is a preparatory change for normalizing include order.

There is a commented out include. Remove it so we don't keep dead code
in the includes sections.

Task-number: QTBUG-148892
Change-Id: I1eb14958443514976b4edb1663860da060ef144b
Reviewed-by: SanthoshKumar Selvaraj <[email protected]>
(cherry picked from commit 43238ca0fde83b37192825a6581b636a8c2abeca)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/49ddc8a0d232b9bd48fc6e149fb33848f87f0254

Git commit ff10ff766e0e8e809583273b3f94ee0fd1dab53a by Qt Cherry-pick Bot (on behalf of Aleksander Wawrzyniak) on 07/08/2026 at 11:53..
harmonyos: fix formatting of include directive

This is a preparatory change to normalizing includes in harmonyos
platform code.

There is an include, which doesn't add space after the #include. Fix
this formatting.

Task-number: QTBUG-148892
Change-Id: I2b59e8a99dc7650a0f12c6e83d8939b490cd1450
Reviewed-by: SanthoshKumar Selvaraj <[email protected]>
(cherry picked from commit 37b7ee1ea35cf86439289944703ffdf098e22b08)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/ff10ff766e0e8e809583273b3f94ee0fd1dab53a

Git commit a0c828d4b44b4b87eb9130c2f16c73c77dc1aa1c by Qt Cherry-pick Bot (on behalf of Aleksander Wawrzyniak) on 07/08/2026 at 11:53..
harmonyos: Remove duplicate includes

This is a preparatory change to normalizing includes in harmonyos
platform code.

There are two instances of duplicated includes:
  1. qohosplatformscreen.cpp: QtGui/qguiapplication.h
  2. qohosplatformwindow.cpp: QtGui/private/qwindow_p.h

These duplicates differ only in having the Qt module prefix (QtGui/) in
the include path. Follow the Qt coding guidelines and remove the ones,
which are missing the Qt module prefix.

Task-number: QTBUG-148892
Change-Id: Ic360c32f869a34049553e92b7aca89fb6ca9ece6
Reviewed-by: Liang Qi <[email protected]>
(cherry picked from commit 19332ec588d30f6b4a36081880bfd4d1366b92cf)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/a0c828d4b44b4b87eb9130c2f16c73c77dc1aa1c