Do not access accessibility from qt post routines

It seems accessing accessibility from qt post routines ends
badly since caches are gone already.

Add closingDown() function to web context, which is similar to
QCoreApplication::closingDown(), however return true on
post routine.

Guard delete accessibility calls.

Note the widget part is not necessary, but added for completeness,
since only qml can release profiles due to garbage collection.

Fixes: QTBUG-90904
Change-Id: Ic0e7115cd17eb58f3d58f70fefbc197dfb7a6493
Reviewed-by: Michael Brüning <michael.bruning@qt.io>
(cherry picked from commit 89bb3c97eee9cd4bf9fb536f024715e606e49ae0)

6 files changed, 26 insertions, 4 deletions

diff --git a/src/core/api/qtwebenginecoreglobal.cpp b/src/core/api/qtwebenginecoreglobal.cpp
index 5bf46f782..5215f7ce7 100644
--- a/src/core/api/qtwebenginecoreglobal.cpp
+++ b/src/core/api/qtwebenginecoreglobal.cpp
@@ -51,6 +51,7 @@
 #endif
 #include <QThread>
 #include <QQuickWindow>
+#include "web_engine_context.h"
 
 #if QT_CONFIG(opengl)
 QT_BEGIN_NAMESPACE
@@ -206,6 +207,12 @@ Q_WEBENGINECORE_PRIVATE_EXPORT void initialize()
 
 #endif // QT_CONFIG(opengl)
 }
+
+bool closingDown()
+{
+    return WebEngineContext::closingDown();
+}
+
 } // namespace QtWebEngineCore
 
 #if defined(Q_OS_WIN)
diff --git a/src/core/api/qtwebenginecoreglobal_p.h b/src/core/api/qtwebenginecoreglobal_p.h
index 8214fc19c..a716f5827 100644
--- a/src/core/api/qtwebenginecoreglobal_p.h
+++ b/src/core/api/qtwebenginecoreglobal_p.h
@@ -67,6 +67,7 @@
 
 namespace QtWebEngineCore {
 Q_WEBENGINECORE_PRIVATE_EXPORT int processMain(int argc, const char **argv);
+Q_WEBENGINECORE_PRIVATE_EXPORT bool closingDown();
 } // namespace
 #if defined(Q_OS_WIN)
 namespace sandbox {
diff --git a/src/core/web_engine_context.cpp b/src/core/web_engine_context.cpp
index 5a069ead6..77ac52c36 100644
--- a/src/core/web_engine_context.cpp
+++ b/src/core/web_engine_context.cpp
@@ -384,7 +384,7 @@ static QStringList parseEnvCommandLine(const QString &cmdLine)
 
 scoped_refptr<QtWebEngineCore::WebEngineContext> WebEngineContext::m_handle;
 bool WebEngineContext::m_destroyed = false;
-
+bool WebEngineContext::m_closingDown = false;
 void WebEngineContext::destroyProfileAdapter()
 {
     if (content::RenderProcessHost::run_renderer_in_process()) {
@@ -553,6 +553,7 @@ void WebEngineContext::destroyContextPostRoutine()
     // Destroy WebEngineContext before its static pointer is zeroed and destructor called.
     // Before destroying MessageLoop via destroying BrowserMainRunner destructor
     // WebEngineContext's pointer is used.
+    m_closingDown = true;
     m_handle->destroy();
 #if !defined(NDEBUG)
     if (!m_handle->HasOneRef())
@@ -921,6 +922,11 @@ base::CommandLine* WebEngineContext::commandLine() {
     }
 }
 
+bool WebEngineContext::closingDown()
+{
+    return m_closingDown;
+}
+
 } // namespace
 
 QT_BEGIN_NAMESPACE
diff --git a/src/core/web_engine_context.h b/src/core/web_engine_context.h
index accfa34e1..27eae95bf 100644
--- a/src/core/web_engine_context.h
+++ b/src/core/web_engine_context.h
@@ -105,7 +105,7 @@ public:
     static void destroyContextPostRoutine();
     static ProxyAuthentication qProxyNetworkAuthentication(QString host, int port);
     static void flushMessages();
-
+    static bool closingDown();
     ProfileAdapter *createDefaultProfileAdapter();
     ProfileAdapter *defaultProfileAdapter();
 
@@ -158,6 +158,7 @@ private:
 #endif
     static scoped_refptr<QtWebEngineCore::WebEngineContext> m_handle;
     static bool m_destroyed;
+    static bool m_closingDown;
     static QAtomicPointer<gpu::SyncPointManager> s_syncPointManager;
 };
 
diff --git a/src/webenginequick/api/qquickwebengineview.cpp b/src/webenginequick/api/qquickwebengineview.cpp
index 8f02648e8..7e2240698 100644
--- a/src/webenginequick/api/qquickwebengineview.cpp
+++ b/src/webenginequick/api/qquickwebengineview.cpp
@@ -74,6 +74,7 @@
 #include <QtWebEngineCore/private/qwebenginehistory_p.h>
 #include <QtWebEngineCore/private/qwebenginenewwindowrequest_p.h>
 #include <QtWebEngineCore/private/qwebenginescriptcollection_p.h>
+#include <QtWebEngineCore/private/qtwebenginecoreglobal_p.h>
 
 #include <QtCore/qloggingcategory.h>
 #include <QtCore/qmimedata.h>
@@ -926,11 +927,14 @@ void QQuickWebEngineViewPrivate::widgetChanged(RenderWidgetHostViewQtDelegateQui
     if (oldWidget) {
         oldWidget->setParentItem(nullptr);
 #if QT_CONFIG(accessibility)
-        QAccessible::deleteAccessibleInterface(QAccessible::uniqueId(QAccessible::queryAccessibleInterface(oldWidget)));
+        if (!QtWebEngineCore::closingDown())
+            QAccessible::deleteAccessibleInterface(
+                    QAccessible::uniqueId(QAccessible::queryAccessibleInterface(oldWidget)));
 #endif
     }
 
     if (newWidget) {
+        Q_ASSERT(!QtWebEngineCore::closingDown());
 #if QT_CONFIG(accessibility)
         QAccessible::registerAccessibleInterface(new QtWebEngineCore::RenderWidgetHostViewQtDelegateQuickAccessible(newWidget, q));
 #endif
diff --git a/src/webenginewidgets/api/qwebengineview.cpp b/src/webenginewidgets/api/qwebengineview.cpp
index 6414ac050..889a6be76 100644
--- a/src/webenginewidgets/api/qwebengineview.cpp
+++ b/src/webenginewidgets/api/qwebengineview.cpp
@@ -153,11 +153,14 @@ void QWebEngineViewPrivate::widgetChanged(QtWebEngineCore::RenderWidgetHostViewQ
         q->layout()->removeWidget(oldWidget);
         oldWidget->hide();
 #if QT_CONFIG(accessibility)
-        QAccessible::deleteAccessibleInterface(QAccessible::uniqueId(QAccessible::queryAccessibleInterface(oldWidget)));
+        if (!QtWebEngineCore::closingDown())
+            QAccessible::deleteAccessibleInterface(
+                    QAccessible::uniqueId(QAccessible::queryAccessibleInterface(oldWidget)));
 #endif
     }
 
     if (newWidget) {
+        Q_ASSERT(!QtWebEngineCore::closingDown());
 #if QT_CONFIG(accessibility)
         // An earlier QAccessible::queryAccessibleInterface() call may have already registered a default
         // QAccessibleInterface for newWidget: remove it first to avoid assert in QAccessibleCache::insert().