Segmentation faults in QRasterPaintEngine while implementing a minimal screen driver

I have implemented a minimal screen driver for QWS by subclassing the QScreenDriverPlugin, QScreen, QWSWindowSurface, QCustomRasterPaintDevice and QRasterPaintEngine classes as described in "Adding an Accelerated Graphics Driver to Qt for Embedded Linux" in the Documentation. As suggested by the article, I have declared all pure virtual functions of the above classes and have implemented them to provide minimal functionality. More specifically, I have implemented:

QScreen::connect()
QScreen::disconnect()
QScreen::initDevice()
QScreen::shutdownDevice()
QScreen::setMode()
QRasterPaintEngine::drawBufferSpan()
QRasterPaintEngine::drawColorSpans()

to do nothing or return true;

QScreen::createSurface()

(both overloads)
QWSWindowSurface::isValid()

QWSWindowSurface::image()

QWSWindowSurface::paintDevice()

QWSWindowSurface::paintEngine()

QWSWindowSurface::memory()

So, the implementation is quite minimal.

Everything compiles well and the driver gets loaded but I get a segmentation fault here:
#0 0x00007ffff6f73848 in QScopedPointer<QObjectData, QScopedPointerDeleter<QObjectData> >::data (this=0x8) at ../../include/QtCore/../../src/corelib/tools/qscopedpointer.h:135
#1 0x00007ffff6f77f7d in qGetPtrHelper<QScopedPointer<QObjectData, QScopedPointerDeleter<QObjectData> > > (p=...) at ../../include/QtCore/../../src/corelib/global/qglobal.h:2314
#2 0x00007ffff6f84a47 in QWidget::d_func (this=0x0) at ../../include/QtGui/../../src/gui/kernel/qwidget.h:143
#3 0x00007ffff701cecc in QWidget::frameGeometry (this=0x0) at kernel/qwidget.cpp:3244
#4 0x00007ffff7197039 in QCustomRasterPaintDevice::metric (this=0x8911c8, m=QPaintDevice::PdmHeight) at painting/qpaintengine_raster.cpp:4230
#5 0x00007ffff7034aab in QPaintDevice::height (this=0x8911c8) at ../../include/QtGui/../../src/gui/painting/qpaintdevice.h:92
#6 0x00007ffff71ab493 in QRasterPaintEngine::init (this=0x891840) at painting/qpaintengine_raster.cpp:367
#7 0x00007ffff71ab8ce in QRasterPaintEngine (this=0x891840, device=0x8911c8) at painting/qpaintengine_raster.cpp:316
#8 0x00007ffff382cb07 in QMyDriverPaintEngine (this=0x891840, device=0x8911c8) at qmydriver_paintengine.cpp:50
#9 0x00007ffff382e43d in QMyDriverWindowSurface (this=0x8911b0, screen=0x62ea30) at qmydriver_windowsurface.cpp:21
#10 0x00007ffff382d517 in QMyDriverScreen::createSurface (this=0x62ea30, key=...) at qmydriver_screen.cpp:127
#11 0x00007ffff6f910ca in QWSWindow::createSurface (this=0x874bb0, key=..., data=...) at embedded/qwindowsystem_qws.cpp:436
#12 0x00007ffff6f97734 in QWSServerPrivate::request_region (this=0x61fac0, wid=1000, surfaceKey=..., surfaceData=..., region=...) at embedded/qwindowsystem_qws.cpp:3890
#13 0x00007ffff7052acf in QWSDisplay::requestRegion (this=0x61f7c0, winId=1000, surfaceKey=..., surfaceData=..., region=...) at kernel/qapplication_qws.cpp:1522
#14 0x00007ffff72260cb in QWSWindowSurface::setGeometry (this=0x6582e0, rect=..., mask=...) at painting/qwindowsurface_qws.cpp:628
#15 0x00007ffff7224095 in QWSWindowSurface::setGeometry (this=0x6582e0, rect=...) at painting/qwindowsurface_qws.cpp:608
#16 0x00007ffff70616a9 in QWidgetPrivate::show_sys (this=0x63d9f0) at kernel/qwidget_qws.cpp:597
#17 0x00007ffff70307dc in QWidgetPrivate::show_helper (this=0x63d9f0) at kernel/qwidget.cpp:7230
#18 0x00007ffff7030dce in QWidget::setVisible (this=0x7fffffffe170, visible=true) at kernel/qwidget.cpp:7444
#19 0x00000000004073c3 in QWidget::show (this=0x7fffffffe170) at ../../include/QtGui/../../src/gui/kernel/qwidget.h:485
#20 0x0000000000407376 in main (argc=1, argv=0x7fffffffe338) at main.cpp:53

As I found out, it is necessary to also implement the QWSWindowSurface::metric() function, but this is nowhere mentioned; so, I consider this to be a bug either in the QWS system or in the documentation.

After I fixed that, I got another segmentation fault here:
#0 0x00007ffff70bf6e6 in qt_blend_argb32_on_argb32 (destPixels=0x64708 <Address 0x64708 out of bounds>, dbpl=4096,
srcPixels=0x8713f0 '\001' <repeats 20 times>, "\003\004\006o\001\001\001\021", '\001' <repeats 56 times>, "\032\060G\204\r\034,\231", '\001' <repeats 53 times>, "\002\002\002\031&1s?\212\305\375\002\003\004B", '\001' <repeats 40 times>..., sbpl=64, w=16, h=16, const_alpha=256) at painting/qblendfunctions.cpp:589
#1 0x00007ffff719d8aa in QRasterPaintEnginePrivate::drawImage (this=0x875100, pt=..., img=..., func=0x7ffff70bf632 <qt_blend_argb32_on_argb32>, clip=..., alpha=256, sr=...) at painting/qpaintengine_raster.cpp:1079
#2 0x00007ffff719dbf2 in QRasterPaintEngine::drawImage (this=0x874480, p=..., img=...) at painting/qpaintengine_raster.cpp:2508
#3 0x00007ffff71a87e4 in QRasterPaintEngine::drawPixmap (this=0x874480, pos=..., pixmap=...) at painting/qpaintengine_raster.cpp:2386
#4 0x00007ffff7119d83 in QPainter::drawPixmap (this=0x7fffffffa420, p=..., pm=...) at painting/qpainter.cpp:5254
#5 0x0000000000407290 in QPainter::drawPixmap (this=0x7fffffffa420, x=400, y=6, pm=...) at ../../include/QtGui/../../src/gui/painting/qpainter.h:821
#6 0x000000000040609d in BookDelegate::paint (this=0x811c90, painter=0x7fffffffa420, option=..., index=...) at bookdelegate.cpp:72
#7 0x00007ffff75848af in QTableViewPrivate::drawCell (this=0x630740, painter=0x7fffffffa420, option=..., index=...) at itemviews/qtableview.cpp:935
#8 0x00007ffff75867d4 in QTableView::paintEvent (this=0x6305f0, event=0x7fffffffb5d0) at itemviews/qtableview.cpp:1407
#9 0x00007ffff702d70f in QWidget::event (this=0x6305f0, event=0x7fffffffb5d0) at kernel/qwidget.cpp:8190
#10 0x00007ffff7422bcf in QFrame::event (this=0x6305f0, e=0x7fffffffb5d0) at widgets/qframe.cpp:557
#11 0x00007ffff74b5a56 in QAbstractScrollArea::viewportEvent (this=0x6305f0, e=0x7fffffffb5d0) at widgets/qabstractscrollarea.cpp:1036
#12 0x00007ffff75560c0 in QAbstractItemView::viewportEvent (this=0x6305f0, event=0x7fffffffb5d0) at itemviews/qabstractitemview.cpp:1615
#13 0x00007ffff74b866e in QAbstractScrollAreaPrivate::viewportEvent (this=0x630740, event=0x7fffffffb5d0) at widgets/qabstractscrollarea_p.h:100
#14 0x00007ffff74b86ae in QAbstractScrollAreaFilter::eventFilter (this=0x63f390, o=0x62fbb0, e=0x7fffffffb5d0) at widgets/qabstractscrollarea_p.h:116
#15 0x00007ffff6662e2f in QCoreApplicationPrivate::sendThroughObjectEventFilters (this=0x60f460, receiver=0x62fbb0, event=0x7fffffffb5d0) at kernel/qcoreapplication.cpp:841
#16 0x00007ffff6fc8674 in QApplicationPrivate::notify_helper (this=0x60f460, receiver=0x62fbb0, e=0x7fffffffb5d0) at kernel/qapplication.cpp:4298
#17 0x00007ffff6fcb312 in QApplication::notify (this=0x7fffffffe230, receiver=0x62fbb0, e=0x7fffffffb5d0) at kernel/qapplication.cpp:4267
#18 0x00007ffff6664b20 in QCoreApplication::notifyInternal (this=0x7fffffffe230, receiver=0x62fbb0, event=0x7fffffffb5d0) at kernel/qcoreapplication.cpp:726
#19 0x00007ffff6fd90c7 in QCoreApplication::sendSpontaneousEvent (receiver=0x62fbb0, event=0x7fffffffb5d0) at ../../include/QtCore/../../src/corelib/kernel/qcoreapplication.h:218
#20 0x00007ffff702a832 in QWidgetPrivate::drawWidget (this=0x630b50, pdev=0x6582f8, rgn=..., offset=..., flags=4, sharedPainter=0x0, backingStore=0x874de0) at kernel/qwidget.cpp:5363
#21 0x00007ffff702b065 in QWidgetPrivate::paintSiblingsRecursive (this=0x630740, pdev=0x6582f8, siblings=..., index=0, rgn=..., offset=..., flags=4, sharedPainter=0x0, backingStore=0x874de0) at kernel/qwidget.cpp:5476
#22 0x00007ffff702af11 in QWidgetPrivate::paintSiblingsRecursive (this=0x630740, pdev=0x6582f8, siblings=..., index=1, rgn=..., offset=..., flags=4, sharedPainter=0x0, backingStore=0x874de0) at kernel/qwidget.cpp:5463
#23 0x00007ffff702af11 in QWidgetPrivate::paintSiblingsRecursive (this=0x630740, pdev=0x6582f8, siblings=..., index=2, rgn=..., offset=..., flags=4, sharedPainter=0x0, backingStore=0x874de0) at kernel/qwidget.cpp:5463
#24 0x00007ffff702af11 in QWidgetPrivate::paintSiblingsRecursive (this=0x630740, pdev=0x6582f8, siblings=..., index=3, rgn=..., offset=..., flags=4, sharedPainter=0x0, backingStore=0x874de0) at kernel/qwidget.cpp:5463
#25 0x00007ffff702af11 in QWidgetPrivate::paintSiblingsRecursive (this=0x630740, pdev=0x6582f8, siblings=..., index=8, rgn=..., offset=..., flags=4, sharedPainter=0x0, backingStore=0x874de0) at kernel/qwidget.cpp:5463
#26 0x00007ffff702abf4 in QWidgetPrivate::drawWidget (this=0x630740, pdev=0x6582f8, rgn=..., offset=..., flags=4, sharedPainter=0x0, backingStore=0x874de0) at kernel/qwidget.cpp:5412
#27 0x00007ffff702b065 in QWidgetPrivate::paintSiblingsRecursive (this=0x63b3d0, pdev=0x6582f8, siblings=..., index=0, rgn=..., offset=..., flags=4, sharedPainter=0x0, backingStore=0x874de0) at kernel/qwidget.cpp:5476
#28 0x00007ffff702af11 in QWidgetPrivate::paintSiblingsRecursive (this=0x63b3d0, pdev=0x6582f8, siblings=..., index=1, rgn=..., offset=..., flags=4, sharedPainter=0x0, backingStore=0x874de0) at kernel/qwidget.cpp:5463
#29 0x00007ffff702abf4 in QWidgetPrivate::drawWidget (this=0x63b3d0, pdev=0x6582f8, rgn=..., offset=..., flags=4, sharedPainter=0x0, backingStore=0x874de0) at kernel/qwidget.cpp:5412
#30 0x00007ffff702b065 in QWidgetPrivate::paintSiblingsRecursive (this=0x62f5f0, pdev=0x6582f8, siblings=..., index=0, rgn=..., offset=..., flags=4, sharedPainter=0x0, backingStore=0x874de0) at kernel/qwidget.cpp:5476
#31 0x00007ffff702abf4 in QWidgetPrivate::drawWidget (this=0x62f5f0, pdev=0x6582f8, rgn=..., offset=..., flags=4, sharedPainter=0x0, backingStore=0x874de0) at kernel/qwidget.cpp:5412
#32 0x00007ffff702b065 in QWidgetPrivate::paintSiblingsRecursive (this=0x63d9f0, pdev=0x6582f8, siblings=..., index=1, rgn=..., offset=..., flags=4, sharedPainter=0x0, backingStore=0x874de0) at kernel/qwidget.cpp:5476
#33 0x00007ffff702abf4 in QWidgetPrivate::drawWidget (this=0x63d9f0, pdev=0x6582f8, rgn=..., offset=..., flags=5, sharedPainter=0x0, backingStore=0x874de0) at kernel/qwidget.cpp:5412
#34 0x00007ffff7220da3 in QWidgetBackingStore::sync (this=0x874de0) at painting/qbackingstore.cpp:1300
#35 0x00007ffff7023f8e in QWidgetPrivate::syncBackingStore (this=0x63d9f0) at kernel/qwidget.cpp:1688
#36 0x00007ffff702dcc9 in QWidget::event (this=0x7fffffffe170, event=0x891700) at kernel/qwidget.cpp:8337
#37 0x00007ffff7441c6f in QMainWindow::event (this=0x7fffffffe170, event=0x891700) at widgets/qmainwindow.cpp:1414
#38 0x00007ffff6fc8699 in QApplicationPrivate::notify_helper (this=0x60f460, receiver=0x7fffffffe170, e=0x891700) at kernel/qapplication.cpp:4302
#39 0x00007ffff6fcb312 in QApplication::notify (this=0x7fffffffe230, receiver=0x7fffffffe170, e=0x891700) at kernel/qapplication.cpp:4267
#40 0x00007ffff6664b20 in QCoreApplication::notifyInternal (this=0x7fffffffe230, receiver=0x7fffffffe170, event=0x891700) at kernel/qcoreapplication.cpp:726
#41 0x00007ffff6fc5cf1 in QCoreApplication::sendEvent (receiver=0x7fffffffe170, event=0x891700) at ../../include/QtCore/../../src/corelib/kernel/qcoreapplication.h:215
#42 0x00007ffff66650a6 in QCoreApplicationPrivate::sendPostedEvents (receiver=0x0, event_type=0, data=0x60f5e0) at kernel/qcoreapplication.cpp:1364
#43 0x00007ffff6665270 in QCoreApplication::sendPostedEvents (receiver=0x0, event_type=0) at kernel/qcoreapplication.cpp:1260
#44 0x00007ffff6fa76b5 in QCoreApplication::sendPostedEvents () at ../../include/QtCore/../../src/corelib/kernel/qcoreapplication.h:220
#45 0x00007ffff6695a53 in postEventSourceDispatch (s=0x61cb80) at kernel/qeventdispatcher_glib.cpp:276
#46 0x00007ffff530fbce in g_main_context_dispatch () from /lib/libglib-2.0.so.0
#47 0x00007ffff5313598 in ?? () from /lib/libglib-2.0.so.0
#48 0x00007ffff53136c0 in g_main_context_iteration () from /lib/libglib-2.0.so.0
#49 0x00007ffff6694e79 in QEventDispatcherGlib::processEvents (this=0x619170, flags=...) at kernel/qeventdispatcher_glib.cpp:412
#50 0x00007ffff7063699 in QWSEventDispatcherGlib::processEvents (this=0x619170, flags=...) at kernel/qeventdispatcher_glib_qws.cpp:183
#51 0x00007ffff6661850 in QEventLoop::processEvents (this=0x7fffffffe110, flags=...) at kernel/qeventloop.cpp:149
#52 0x00007ffff6661a73 in QEventLoop::exec (this=0x7fffffffe110, flags=...) at kernel/qeventloop.cpp:197
#53 0x00007ffff6665392 in QCoreApplication::exec () at kernel/qcoreapplication.cpp:1003
#54 0x00007ffff6fcb354 in QApplication::exec () at kernel/qapplication.cpp:3581
#55 0x000000000040737b in main (argc=1, argv=0x7fffffffe338) at main.cpp:55

Apparently, the segmentation fault is caused by QRasterBuffer::m_buffer being 0 and not using the right draw helper. This happens when QRasterPaintEngine::drawPixmap is called while clipping has been set.