summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJüri Valdmann <juri.valdmann@qt.io>2019-07-17 13:16:23 +0200
committerJüri Valdmann <juri.valdmann@qt.io>2019-07-18 10:18:31 +0200
commit662de14ceecee701b31478849ae147c70f3fe00f (patch)
tree9be7bcde580a94cb6c7d1095d9e2d1b7325c515f
parentb4589db4c7cb10cb55b38bab00d80eb1290312b1 (diff)
Fix use-after-free in WebContentsAdapter::load
Pass WebContentsAdapter pointer to lambda via QWeakPointer in case the adapter has been deleted already. Fixes: QTBUG-76958 Change-Id: I1962ba3dd1794a27e7013a2ad1b729fe7a08c079 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
-rw-r--r--src/core/web_contents_adapter.cpp10
1 files changed, 7 insertions, 3 deletions
diff --git a/src/core/web_contents_adapter.cpp b/src/core/web_contents_adapter.cpp
index a342ba30..f74f16bc 100644
--- a/src/core/web_contents_adapter.cpp
+++ b/src/core/web_contents_adapter.cpp
@@ -653,19 +653,23 @@ void WebContentsAdapter::load(const QWebEngineHttpRequest &request)
}
}
- auto navigate = [](WebContentsAdapter *adapter, const content::NavigationController::LoadURLParams &params) {
+ auto navigate = [](QWeakPointer<WebContentsAdapter> weakAdapter, const content::NavigationController::LoadURLParams &params) {
+ WebContentsAdapter *adapter = weakAdapter.data();
+ if (!adapter)
+ return;
adapter->webContents()->GetController().LoadURLWithParams(params);
// Follow chrome::Navigate and invalidate the URL immediately.
adapter->m_webContentsDelegate->NavigationStateChanged(adapter->webContents(), content::INVALIDATE_TYPE_URL);
adapter->focusIfNecessary();
};
+ QWeakPointer<WebContentsAdapter> weakThis(sharedFromThis());
if (resizeNeeded) {
// Schedule navigation on the event loop.
content::BrowserThread::PostTask(
- content::BrowserThread::UI, FROM_HERE, base::BindOnce(navigate, this, std::move(params)));
+ content::BrowserThread::UI, FROM_HERE, base::BindOnce(navigate, std::move(weakThis), std::move(params)));
} else {
- navigate(this, params);
+ navigate(std::move(weakThis), params);
}
}