Merge branch '4.7' of scm.dev.nokia.troll.no:qt/oslo-staging-1 into 4.7-integration

* '4.7' of scm.dev.nokia.troll.no:qt/oslo-staging-1:
  Fix NB#290352 Qtwebprocess crashes @ QHttpNetworkReply::readAny

2 files changed, 50 insertions, 0 deletions

diff --git a/src/network/access/qnetworkaccesshttpbackend.cpp b/src/network/access/qnetworkaccesshttpbackend.cpp
index aa477fbd4d..42dc33dd76 100644
--- a/src/network/access/qnetworkaccesshttpbackend.cpp
+++ b/src/network/access/qnetworkaccesshttpbackend.cpp
@@ -721,6 +721,12 @@ void QNetworkAccessHttpBackend::readFromHttp()
     if (!httpReply)
         return;
 
+    if (!http) {
+        // Connection has been destroyed
+        finished();
+        return;
+    }
+
     // We read possibly more than nextDownstreamBlockSize(), but
     // this is not a critical thing since it is already in the
     // memory anyway
diff --git a/tests/auto/qnetworkreply/tst_qnetworkreply.cpp b/tests/auto/qnetworkreply/tst_qnetworkreply.cpp
index 28832b2089..d4e388d643 100644
--- a/tests/auto/qnetworkreply/tst_qnetworkreply.cpp
+++ b/tests/auto/qnetworkreply/tst_qnetworkreply.cpp
@@ -317,6 +317,8 @@ private Q_SLOTS:
     void getAndThenDeleteObject_data();
     void getAndThenDeleteObject();
 
+    void deleteManagerWhileGetIsInProgress();
+
     void symbianOpenCDataUrlCrash();
 
     void qtbug12908compressedHttpReply();
@@ -5109,6 +5111,48 @@ void tst_QNetworkReply::getAndThenDeleteObject()
     }
 }
 
+void tst_QNetworkReply::deleteManagerWhileGetIsInProgress()
+{
+    // yes, this will leak if the testcase fails. I don't care. It must not fail then :P
+    QNetworkAccessManager *manager = new QNetworkAccessManager();
+    QNetworkRequest request("http://" + QtNetworkSettings::serverName() + "/qtest/bigfile");
+    QNetworkReply *reply = manager->get(request);
+    reply->setReadBufferSize(1024);
+
+    // Reset reply's parent to allow it to outlive the manager
+    reply->setParent(0);
+
+    // Wait until a buffer is received
+    int totalWait = 0;
+    while (!reply->bytesAvailable()) {
+        QTest::qWait(20);
+        totalWait += 20;
+        QVERIFY( totalWait <= 5*1000);
+    }
+
+    QVERIFY(reply->bytesAvailable());
+    QCOMPARE(reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt(), 200);
+    QVERIFY(!reply->isFinished()); // must not be finished
+
+    // Read the data to request next buffer's worth from the server
+    (void)reply->readAll();
+
+    QSignalSpy replyFinishedSpy(reply, SIGNAL(finished()));
+
+    // Delete the manager
+    delete manager;
+    manager = 0;
+
+    // Wait to allow reply to process any pending events
+    QTest::qWait(100);
+
+    // The reply should be finished
+    QVERIFY(reply->isFinished());
+    QCOMPARE(replyFinishedSpy.count(), 1);
+
+    delete reply;
+}
+
 // see https://bugs.webkit.org/show_bug.cgi?id=38935
 void tst_QNetworkReply::symbianOpenCDataUrlCrash()
 {