Race condition on QGradientCache::getBuffer()

getBuffer() hands out a reference to internal data without ref-counting it.

There's a mutex, but it only protects access to the QHash. That's necessary, but not sufficient if the function hands out pointers to data stored in the hash.

GCC ASAN report follows.