Fix race condition in ResourceDispatcherHostLoginDelegateQt

Do no access m_request from ui thread. The auth request can get cancelled,
this can happen for example when a new navigation interrupts the current one.

Fixes: QTBUG-71128
Change-Id: I140b1a164294342bad13a76342c1f642ba0960c8
Reviewed-by: Kai Koehne <kai.koehne@qt.io>

2 files changed, 5 insertions, 3 deletions

diff --git a/src/core/renderer_host/resource_dispatcher_host_delegate_qt.cpp b/src/core/renderer_host/resource_dispatcher_host_delegate_qt.cpp
index 421b3167b..eb43f46ad 100644
--- a/src/core/renderer_host/resource_dispatcher_host_delegate_qt.cpp
+++ b/src/core/renderer_host/resource_dispatcher_host_delegate_qt.cpp
@@ -59,6 +59,7 @@ namespace QtWebEngineCore {
 ResourceDispatcherHostLoginDelegateQt::ResourceDispatcherHostLoginDelegateQt(net::AuthChallengeInfo *authInfo, net::URLRequest *request)
     : m_authInfo(authInfo)
     , m_request(request)
+    , m_url(request->url())
 {
     Q_ASSERT(content::BrowserThread::CurrentlyOn(content::BrowserThread::IO));
     const content::ResourceRequestInfo *requestInfo = content::ResourceRequestInfo::ForRequest(request);
@@ -81,11 +82,12 @@ ResourceDispatcherHostLoginDelegateQt::~ResourceDispatcherHostLoginDelegateQt()
 void ResourceDispatcherHostLoginDelegateQt::OnRequestCancelled()
 {
     destroy();
+    // TODO: this should close native dialog, since page can be navigated somewhere else
 }
 
 QUrl ResourceDispatcherHostLoginDelegateQt::url() const
 {
-    return toQt(m_request->url());
+    return toQt(m_url);
 }
 
 QString ResourceDispatcherHostLoginDelegateQt::realm() const
@@ -135,7 +137,7 @@ void ResourceDispatcherHostLoginDelegateQt::sendAuthToRequester(bool success, co
 void ResourceDispatcherHostLoginDelegateQt::destroy()
 {
     m_dialogController.reset();
-    m_request = 0;
+    m_request = nullptr;
 }
 
 static void LaunchURL(const GURL& url, int render_process_id,
diff --git a/src/core/renderer_host/resource_dispatcher_host_delegate_qt.h b/src/core/renderer_host/resource_dispatcher_host_delegate_qt.h
index c254a60f5..fa1f8108f 100644
--- a/src/core/renderer_host/resource_dispatcher_host_delegate_qt.h
+++ b/src/core/renderer_host/resource_dispatcher_host_delegate_qt.h
@@ -73,7 +73,7 @@ private:
     // The request that wants login data.
     // Must only be accessed on the IO thread.
     net::URLRequest *m_request;
-
+    GURL m_url;
     // This member is used to keep authentication dialog controller alive until
     // authorization is sent or cancelled.
     QSharedPointer<AuthenticationDialogController> m_dialogController;