SPDY must handle destoyed QNetworkReply

A QNetworkReply may be deleted before it is closed by the protocol.
Since QSpdyProtocolHandler tracks pointers to QNetworkReplies it must
keep track of their destruction as well to avoid links to deleted
objects.

This fixes the last issue with SPDY access of Google Mail in QtWebKit.

Change-Id: I2c56dc080fdcb249b6ed9189fef84cbbc1220cbd
Reviewed-by: Peter Hartmann <phartmann@blackberry.com>

1 files changed, 9 insertions, 0 deletions

diff --git a/src/network/access/qspdyprotocolhandler.cpp b/src/network/access/qspdyprotocolhandler.cpp
index ce8a2d2b1d..6d5885eb68 100644
--- a/src/network/access/qspdyprotocolhandler.cpp
+++ b/src/network/access/qspdyprotocolhandler.cpp
@@ -309,11 +309,13 @@ bool QSpdyProtocolHandler::sendRequest()
 
         currentReply->setSpdyWasUsed(true);
         qint32 streamID = generateNextStreamID();
+        currentReply->setProperty("SPDYStreamID", streamID);
 
         currentReply->setRequest(currentRequest);
         currentReply->d_func()->connection = m_connection;
         currentReply->d_func()->connectionChannel = m_channel;
         m_inFlightStreams.insert(streamID, currentPair);
+        connect(currentReply, SIGNAL(destroyed(QObject*)), this, SLOT(_q_replyDestroyed(QObject*)));
 
         sendSYN_STREAM(currentPair, streamID, /* associatedToStreamID = */ 0);
         int requestsRemoved = m_channel->spdyRequestsToSend.remove(
@@ -325,6 +327,13 @@ bool QSpdyProtocolHandler::sendRequest()
     return true;
 }
 
+void QSpdyProtocolHandler::_q_replyDestroyed(QObject* reply)
+{
+    qint32 streamID = reply->property("SPDYStreamID").toInt();
+    if (m_inFlightStreams.remove(streamID))
+        sendRST_STREAM(streamID, RST_STREAM_CANCEL);
+}
+
 void QSpdyProtocolHandler::_q_receiveReply()
 {
     Q_ASSERT(m_socket);