QMultiHash: Retrieve the value before deleting on take()

Otherwise we may perform a use-after-free.

Change-Id: I58080dfc8bb6ef9a86f2118407a05db8ae1ecfbd
Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
Reviewed-by: Lars Knoll <lars.knoll@qt.io>

src/corelib/tools/qhash.h

@@ -1320,14 +1320,16 @@ public:
             return T();
         Chain *e = it.node()->value;
         Q_ASSERT(e);
-        if (!e->next)
+        T t = std::move(e->value);
-            d->erase(it);
+        if (e->next) {
-        else
             it.node()->value = e->next;
+            delete e;
+        } else {
+            // erase() deletes the values.
+            d->erase(it);
+        }
         --m_size;
         Q_ASSERT(m_size >= 0);
-        T t = std::move(e->value);
-        delete e;
         return t;
     }