[qt/qt/qtbase]: Summary of bulk changes made

Git repository change summary for qt/qt/qtbase
Pushed by mirror-service into branch '6.11'.
Changed from 45d25d854a69afe13a5013e6efea25089c371cf5 to b90d3d2fa5ede12894bfe312e70c6ff3b54e0f09
Acknowledgement was received that this change introduces only existing code that has been pushed to another public open source repository.

This change contains the following new commits:

Git commit cdb22a287d066c0af04c9f7589852a802cfaf56e by Qt Cherry-pick Bot (on behalf of Assam Boudjelthia) on 16/08/2026 at 16:48..
Android: Guard touch handling against null fields

m_editText is null when QtWindow is constructed for a foreign
window. m_gestureDetector is briefly null after construction
because it is initialized inside QtNative.runAction(), which
is posted to the Android UI thread; an early touch arriving
before that runnable runs hits a null reference.

onTouchEvent dereferenced both unconditionally and crashed
with a NullPointerException on the first touch landing in
a QtWindow that hosts a foreign view embedded using
QWindow::fromWinId().

Change-Id: I02eb86dd35d5a4edd3395c48e40503f12f4f5c2c
Reviewed-by: Ville Voutilainen <[email protected]>
(cherry picked from commit ef55f427f2c8b410d34f8a7681020a3000cf6866)
(cherry picked from commit 2f43252105aa239de8465614ede69893d94f30d0)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
(cherry picked from commit da8e73b25423b2c2864c7a3138b5d0aa74363d13)
https://invent.kde.org/qt/qt/qtbase/-/commit/cdb22a287d066c0af04c9f7589852a802cfaf56e

Git commit c6501bd68594f1cd336de1a3f2a811f82150d6fa by Qt Cherry-pick Bot (on behalf of Marc Mutz) on 16/08/2026 at 20:31..
QCryptographicHash: defend against -ftrivial-auto-var-init

The char buffer was an obvious candidate (we have fixed dozens of
these over time), and the __attribute__((uninitialized)) saves an
unneeded 1KiB memset there.

The other two are more ... interesting.

It turns out that -ftrivial-auto-var-init, at least in Clang 21, is
_not_ limited, as the name suggests, to _trivial_ automatic
variables: If the ctor of the automatic object is out-of-line, Clang
cannot prove which bytes get initialized, and memsets the whole
sizeof.

In the case of QCryptographicHash/MessageAuthenticationCodePrivate,
the definition is inline (even inlined into the static hash()
functions, as the record shows), but there are just too many bytes
that Clang cannot prove anything about: the QSmallByteArrays for
result and key, and the union over the different contexts, because it
cannot say which algorithm is selected, and the context sizes differ
greatly. So, between the two Private's, it inits about ½KiB each, on
average (O(400) vs O(600)).

Mark them Q_DECL_UNINITIALIZED to avoid this overhead.

The result remains ubsan and asan-clean.

Amends 9ff1e6d80bbd5b44b9ec4c0a837d9a4c962698e4 (6.8).

Pick-to: 6.8
Change-Id: I30f88c37760a551d0de4fe6fcb81308416bc7802
Reviewed-by: Thiago Macieira <[email protected]>
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
(cherry picked from commit 277568e1dcc76778797ad2aac5205d2a0035364b)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
(cherry picked from commit c9f91e64378df29988bc694b86fd9efc450cad6c)
https://invent.kde.org/qt/qt/qtbase/-/commit/c6501bd68594f1cd336de1a3f2a811f82150d6fa

Git commit b90d3d2fa5ede12894bfe312e70c6ff3b54e0f09 by Qt Cherry-pick Bot (on behalf of Marc Mutz) on 16/08/2026 at 20:31..
QHash/QList: defend against -ftrivial-auto-var-init in take()

In order to inject the erase() calls between the move of the element
into the result object and the return from the function, the old code
used a temporary stack object.

This has several drawbacks:

- it breaks NRVO on most compilers, so we wrapped it already in an
  IILE (cf. e2d19b9b8f4f7b87a0a4bfe5b6afd1395685ba20)

- we move twice instead of once (for value_types where move == copy,
  we actually _copy_ twice)

- we use extra stack

The last point is relevant for two reasons:

First, like many containers, we have a problem with very large
value_types whose placement on the stack can exhaust the stack. The
container's placing the object on the stack effectively doubles the
stack requirement vis-a-vis an implementation that would move directly
from the heap to the return value, halving the max size of object we
can handle.

Second, our hardening options, in particular -ftrivial-auto-var-init,
memset such automatic variables when the compiler cannot prove that
the (move, in this case) ctor will initialize all bytes of the
object. Even if our move ctors are typically inline: if the class is
exported, the compiler assumes that the definition can be replaced
(LD_PRELOAD, etc) and still memsets. Also, many of our classes are
still stuck in C++98 and lack move constructors, in which case the
move is actually copying, which typically is out-of-line (and slower).

So the goal must be for our containers to step out of the way and not
use extra stack.

To fix, return directly, then use a QScopeGuard to execute code after
the return statement. This RVOs (no NRVO required) and, since there's
no automatic variable in our stack frame, we're now isolated from
-ftrivial-auto-var-init, too.

Pick-to: 6.8
Change-Id: I0b506c6873f2ca18c76120d4c68884afc7a526a3
Reviewed-by: Thiago Macieira <[email protected]>
Reviewed-by: Tim Blechmann <[email protected]>
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
(cherry picked from commit d7c73fbba2b872381ed1dff7d52bfb8c67a5f271)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
(cherry picked from commit ae962200d79a64607230d06d733c6c5cbf76b552)
https://invent.kde.org/qt/qt/qtbase/-/commit/b90d3d2fa5ede12894bfe312e70c6ff3b54e0f09