Fix crash on exit for view-owned QWebEngineUrlSchemeHandler objects

For view-owned URL scheme handlers the destructor would remove the
handler and then trigger URLRequestContextGetterQt::generateStorage.
This would access the browser context from the IO thread while it
already has been destroyed on the browser thread.
  Increment the ref count for the browser context before every call
of generateStorage, and decrement it when generateStorage is
finished.

Task-number: QTBUG-50160
Change-Id: Id8b1505891ec56e93bf9d47f33bb8bc3304eb55a
Reviewed-by: Kai Koehne <kai.koehne@theqtcompany.com>

3 files changed, 11 insertions, 3 deletions

diff --git a/src/core/url_request_context_getter_qt.cpp b/src/core/url_request_context_getter_qt.cpp
index 618354d1c..20efec295 100644
--- a/src/core/url_request_context_getter_qt.cpp
+++ b/src/core/url_request_context_getter_qt.cpp
@@ -127,8 +127,9 @@ void URLRequestContextGetterQt::updateStorageSettings()
             content::BrowserThread::GetMessageLoopProxyForThread(BrowserThread::IO),
             content::BrowserThread::GetMessageLoopProxyForThread(BrowserThread::FILE)
         ));
-        if (m_storage)
+        if (m_storage) {
             content::BrowserThread::PostTask(content::BrowserThread::IO, FROM_HERE, base::Bind(&URLRequestContextGetterQt::generateStorage, this));
+        }
     }
 }
 
@@ -283,7 +284,7 @@ void URLRequestContextGetterQt::generateUserAgent()
     Q_ASSERT(m_urlRequestContext);
     Q_ASSERT(m_storage);
 
-    m_storage->set_http_user_agent_settings(new HttpUserAgentSettingsQt(m_browserContext));
+    m_storage->set_http_user_agent_settings(new HttpUserAgentSettingsQt(m_browserContext.constData()));
 }
 
 void URLRequestContextGetterQt::updateHttpCache()
diff --git a/src/core/url_request_context_getter_qt.h b/src/core/url_request_context_getter_qt.h
index 8740c65a2..555d56784 100644
--- a/src/core/url_request_context_getter_qt.h
+++ b/src/core/url_request_context_getter_qt.h
@@ -94,7 +94,7 @@ private:
     bool m_ignoreCertificateErrors;
     QAtomicInt m_updateCookieStore;
     QAtomicInt m_updateHttpCache;
-    BrowserContextAdapter *m_browserContext;
+    QExplicitlySharedDataPointer<BrowserContextAdapter> m_browserContext;
     content::ProtocolHandlerMap m_protocolHandlers;
 
     QAtomicPointer<net::ProxyConfigService> m_proxyConfigService;
diff --git a/tests/auto/widgets/qwebengineprofile/tst_qwebengineprofile.cpp b/tests/auto/widgets/qwebengineprofile/tst_qwebengineprofile.cpp
index 0ad460634..99182f155 100644
--- a/tests/auto/widgets/qwebengineprofile/tst_qwebengineprofile.cpp
+++ b/tests/auto/widgets/qwebengineprofile/tst_qwebengineprofile.cpp
@@ -146,6 +146,13 @@ void tst_QWebEngineProfile::urlSchemeHandlers()
     view.load(url);
     QVERIFY(loadFinishedSpy.wait());
     QVERIFY(toPlainTextSync(view.page()) != url.toString());
+
+    // Install a handler that is owned by the view. Make sure this doesn't crash on shutdown.
+    profile.installUrlSchemeHandler("aviancarrier", new ReplyingUrlSchemeHandler(&view));
+    url = QUrl(QStringLiteral("aviancarrier:inspector.mortensen@politistyrke.dk"));
+    view.load(url);
+    QVERIFY(loadFinishedSpy.wait());
+    QCOMPARE(toPlainTextSync(view.page()), url.toString());
 }
 
 class FailingUrlSchemeHandler : public QWebEngineUrlSchemeHandler