Do not access accessibility from qt post routines

It seems accessing accessibility from qt post routines ends
badly since caches are gone already.

Add closingDown() function to web context, which is similar to
QCoreApplication::closingDown(), however return true on
post routine.

Guard delete accessibility calls.

Note the widget part is not necessary, but added for completeness,
since only qml can release profiles due to garbage collection.

Fixes: QTBUG-90904
Change-Id: Ic0e7115cd17eb58f3d58f70fefbc197dfb7a6493
Reviewed-by: Michael Brüning <michael.bruning@qt.io>
(cherry picked from commit 89bb3c97eee9cd4bf9fb536f024715e606e49ae0)
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

6 files changed, 27 insertions, 4 deletions

diff --git a/src/core/api/qtwebenginecoreglobal.cpp b/src/core/api/qtwebenginecoreglobal.cpp
index 3c9387a10..f51aa25c3 100644
--- a/src/core/api/qtwebenginecoreglobal.cpp
+++ b/src/core/api/qtwebenginecoreglobal.cpp
@@ -50,6 +50,7 @@
 #endif
 #endif
 #include <QThread>
+#include "web_engine_context.h"
 
 #if QT_CONFIG(opengl)
 QT_BEGIN_NAMESPACE
@@ -184,4 +185,10 @@ Q_WEBENGINECORE_PRIVATE_EXPORT void initialize()
     app->setAttribute(Qt::AA_ShareOpenGLContexts);
 #endif // QT_CONFIG(opengl)
 }
+
+bool closingDown()
+{
+    return WebEngineContext::closingDown();
+}
+
 } // namespace QtWebEngineCore
diff --git a/src/core/api/qtwebenginecoreglobal_p.h b/src/core/api/qtwebenginecoreglobal_p.h
index 655b2a814..3a3496e04 100644
--- a/src/core/api/qtwebenginecoreglobal_p.h
+++ b/src/core/api/qtwebenginecoreglobal_p.h
@@ -65,4 +65,7 @@
 
 #define Q_WEBENGINECORE_PRIVATE_EXPORT Q_WEBENGINECORE_EXPORT
 
+namespace QtWebEngineCore {
+Q_WEBENGINECORE_PRIVATE_EXPORT bool closingDown();
+} // namespace
 #endif // QTWEBENGINECOREGLOBAL_P_H
diff --git a/src/core/web_engine_context.cpp b/src/core/web_engine_context.cpp
index 0b6450999..6c93dff72 100644
--- a/src/core/web_engine_context.cpp
+++ b/src/core/web_engine_context.cpp
@@ -315,7 +315,7 @@ static QStringList parseEnvCommandLine(const QString &cmdLine)
 
 scoped_refptr<QtWebEngineCore::WebEngineContext> WebEngineContext::m_handle;
 bool WebEngineContext::m_destroyed = false;
-
+bool WebEngineContext::m_closingDown = false;
 void WebEngineContext::destroyProfileAdapter()
 {
     if (content::RenderProcessHost::run_renderer_in_process()) {
@@ -484,6 +484,7 @@ void WebEngineContext::destroyContextPostRoutine()
     // Destroy WebEngineContext before its static pointer is zeroed and destructor called.
     // Before destroying MessageLoop via destroying BrowserMainRunner destructor
     // WebEngineContext's pointer is used.
+    m_closingDown = true;
     m_handle->destroy();
 #if !defined(NDEBUG)
     if (!m_handle->HasOneRef())
@@ -932,4 +933,9 @@ base::CommandLine* WebEngineContext::commandLine() {
     }
 }
 
+bool WebEngineContext::closingDown()
+{
+    return m_closingDown;
+}
+
 } // namespace
diff --git a/src/core/web_engine_context.h b/src/core/web_engine_context.h
index f60082059..2e74a766c 100644
--- a/src/core/web_engine_context.h
+++ b/src/core/web_engine_context.h
@@ -109,7 +109,7 @@ public:
     static void destroyContextPostRoutine();
     static ProxyAuthentication qProxyNetworkAuthentication(QString host, int port);
     static void flushMessages();
-
+    static bool closingDown();
     ProfileAdapter *createDefaultProfileAdapter();
     ProfileAdapter *defaultProfileAdapter();
 
@@ -162,6 +162,7 @@ private:
 #endif
     static scoped_refptr<QtWebEngineCore::WebEngineContext> m_handle;
     static bool m_destroyed;
+    static bool m_closingDown;
     static QAtomicPointer<gpu::SyncPointManager> s_syncPointManager;
 };
 
diff --git a/src/webengine/api/qquickwebengineview.cpp b/src/webengine/api/qquickwebengineview.cpp
index 1de7f1c7f..7164a1c50 100644
--- a/src/webengine/api/qquickwebengineview.cpp
+++ b/src/webengine/api/qquickwebengineview.cpp
@@ -991,11 +991,14 @@ void QQuickWebEngineViewPrivate::widgetChanged(RenderWidgetHostViewQtDelegateQui
     if (oldWidget) {
         oldWidget->setParentItem(nullptr);
 #if QT_CONFIG(accessibility)
-        QAccessible::deleteAccessibleInterface(QAccessible::uniqueId(QAccessible::queryAccessibleInterface(oldWidget)));
+        if (!QtWebEngineCore::closingDown())
+            QAccessible::deleteAccessibleInterface(
+                    QAccessible::uniqueId(QAccessible::queryAccessibleInterface(oldWidget)));
 #endif
     }
 
     if (newWidget) {
+        Q_ASSERT(!QtWebEngineCore::closingDown());
 #if QT_CONFIG(accessibility)
         QAccessible::registerAccessibleInterface(new QtWebEngineCore::RenderWidgetHostViewQtDelegateQuickAccessible(newWidget, q));
 #endif
diff --git a/src/webenginewidgets/api/qwebengineview.cpp b/src/webenginewidgets/api/qwebengineview.cpp
index b1346f65e..46a4887f2 100644
--- a/src/webenginewidgets/api/qwebengineview.cpp
+++ b/src/webenginewidgets/api/qwebengineview.cpp
@@ -116,11 +116,14 @@ void QWebEngineViewPrivate::widgetChanged(QtWebEngineCore::RenderWidgetHostViewQ
         q->layout()->removeWidget(oldWidget);
         oldWidget->hide();
 #if QT_CONFIG(accessibility)
-        QAccessible::deleteAccessibleInterface(QAccessible::uniqueId(QAccessible::queryAccessibleInterface(oldWidget)));
+        if (!QtWebEngineCore::closingDown())
+            QAccessible::deleteAccessibleInterface(
+                    QAccessible::uniqueId(QAccessible::queryAccessibleInterface(oldWidget)));
 #endif
     }
 
     if (newWidget) {
+        Q_ASSERT(!QtWebEngineCore::closingDown());
 #if QT_CONFIG(accessibility)
         // An earlier QAccessible::queryAccessibleInterface() call may have already registered a default
         // QAccessibleInterface for newWidget: remove it first to avoid assert in QAccessibleCache::insert().