Regression: Crash - Multi-threaded text layout with superscript text de-refs a nullptr in QFontEngine due to a race condition

QFontEngine *QTextEngine::fontEngine(const QScriptItem &si, QFixed *ascent, QFixed *descent, QFixed *leading) const {}

                if (valign == QTextCharFormat::AlignSuperScript || valign == QTextCharFormat::AlignSubScript) {
                    if (font.pointSize() != -1)
                        font.setPointSize((font.pointSize() * 2) / 3);
                    else
                        font.setPixelSize((font.pixelSize() * 2) / 3);
                    scaledEngine = font.d->engineForScript(script);
                }

    if (engineData && engineData->fontCacheId != QFontCache::instance()->id()) {
        // throw out engineData that came from a different thread
        if (!engineData->ref.deref())
            delete engineData;
        engineData = 0;
    }

QFontEngine *QTextEngine::fontEngine(const QScriptItem &si, QFixed *ascent, QFixed *descent, QFixed *leading) const
{
<SNIP>
    if (ascent) {
        *ascent = engine->ascent();
        *descent = engine->descent();
        *leading = engine->leading();
    }
}