Merge remote-tracking branch 'origin/5.7' into 5.8

Conflicts:
	src/3rdparty
	src/core/delegated_frame_node.h
	src/webengine/api/qquickwebenginecontextmenudata.cpp

Change-Id: I163488d0d32cd981351608b2886f12e547e24672

17 files changed, 201 insertions, 39 deletions

diff --git a/dist/changes-5.6.2 b/dist/changes-5.6.2
new file mode 100644
index 000000000..7fa2e0052
--- /dev/null
+++ b/dist/changes-5.6.2
@@ -0,0 +1,62 @@
+Qt 5.6.2 is a bug-fix release. It maintains both forward and backward
+compatibility (source and binary) with Qt 5.6.0.
+
+Qt 5.6 introduces many new features and improvements as well as bugfixes
+over the 5.5.x series. For more details, refer to the online documentation
+included in this distribution. The documentation is also available online:
+
+  http://doc.qt.io/qt-5/index.html
+
+The Qt version 5.6 series is binary compatible with the 5.5.x series.
+Applications compiled for 5.5 will continue to run with 5.6.
+
+Some of the changes listed in this file include issue tracking numbers
+corresponding to tasks in the Qt Bug Tracker:
+
+  https://bugreports.qt.io/
+
+Each of these identifiers can be entered in the bug tracker to obtain more
+information about a particular change.
+
+****************************************************************************
+*                             General                                      *
+****************************************************************************
+
+ - Chromium Snapshot:
+   * Security fixes from Chromium up to version 52.0.2743.116.
+    Including: CVE-2016-1706, CVE-2016-1710, CVE-2016-1711, CVE-2016-5127,
+      CVE-2016-5128, CVE-2016-5129, CVE-2016-5130, CVE-2016-5131,
+      CVE-2016-5134, CVE-2016-5137.
+   * [QTBUG-53800] Fixed assert on load.
+
+ - QtWebEngineCore:
+   * Enabled following hotspot hints in custom cursors.
+   * Added support for more CSS cursor types on Windows and Linux.
+   * Fixed several IME issues.
+   * [QTBUG-54419] Fixed crash in user scripts.
+
+ - WebEnginePage:
+   * Fixed crash on blocked new window requests.
+
+
+****************************************************************************
+*                      Platform Specific Changes                           *
+****************************************************************************
+
+ - Linux:
+   * Fixed builds against system FFMPEG 3.
+   * [QTBUG-53956] Fixed builds with GCC 6 that were breaking due to
+     undefined use of 'this' pointer in Chromium.
+   * Removed potential runtime dependency on Linux 4.5 if MADV_FREE was
+     defined.
+   * [QTBUG-53685] Added support for linux-clang-libc++.
+   * [QTBUG-48969, QTBUG-52575] Fixed memory leak when using two separate
+    X11 screens instead of xrandr.
+
+ - Windows:
+   * [QTBUG-48285, QTBUG-52938] Fixed problems with debug symbols.
+   * [QTBUG-54455] Fixed building with VS 2015 update 3.
+
+ - macOS:
+   * [QTBUG-54023] Fixed crash in libjpeg_turbo.
+
diff --git a/src/core/config/linux.pri b/src/core/config/linux.pri
index 5fa93e819..fc2b124fb 100644
--- a/src/core/config/linux.pri
+++ b/src/core/config/linux.pri
@@ -34,7 +34,7 @@ use?(nss) {
         use_openssl_certs=1
 }
 
-gcc:!clang: greaterThan(QT_GCC_MAJOR_VERSION, 5): GYP_CONFIG += v8_no_delete_null_pointer_checks=1
+gcc:!clang: greaterThan(QT_GCC_MAJOR_VERSION, 5): GYP_CONFIG += no_delete_null_pointer_checks=1
 
 qtConfig(system-zlib): use?(system_minizip): GYP_CONFIG += use_system_zlib=1
 qtConfig(system-png): GYP_CONFIG += use_system_libpng=1
diff --git a/src/core/delegated_frame_node.cpp b/src/core/delegated_frame_node.cpp
index d42ad4e7c..3d147226d 100644
--- a/src/core/delegated_frame_node.cpp
+++ b/src/core/delegated_frame_node.cpp
@@ -74,7 +74,6 @@
 #include <QOpenGLFunctions>
 #include <QSGFlatColorMaterial>
 #include <QSGTexture>
-#include <QtGui/QOffscreenSurface>
 #include <private/qsgadaptationlayer_p.h>
 
 #if (QT_VERSION >= QT_VERSION_CHECK(5, 8, 0))
@@ -103,6 +102,7 @@ namespace QtWebEngineCore {
 class MailboxTexture : public QSGTexture, protected QOpenGLFunctions {
 public:
     MailboxTexture(const gpu::MailboxHolder &mailboxHolder, const QSize textureSize);
+    ~MailboxTexture();
     virtual int textureId() const Q_DECL_OVERRIDE { return m_textureId; }
     virtual QSize textureSize() const Q_DECL_OVERRIDE { return m_textureSize; }
     virtual bool hasAlphaChannel() const Q_DECL_OVERRIDE { return m_hasAlpha; }
@@ -120,6 +120,9 @@ private:
     QSize m_textureSize;
     bool m_hasAlpha;
     GLenum m_target;
+#if defined(USE_X11)
+    bool m_ownsTexture;
+#endif
 #ifdef Q_OS_QNX
     EGLStreamData m_eglStreamData;
 #endif
@@ -292,6 +295,9 @@ MailboxTexture::MailboxTexture(const gpu::MailboxHolder &mailboxHolder, const QS
     , m_textureSize(textureSize)
     , m_hasAlpha(false)
     , m_target(GL_TEXTURE_2D)
+#if defined(USE_X11)
+    , m_ownsTexture(false)
+#endif
 {
     initializeOpenGLFunctions();
 
@@ -302,6 +308,21 @@ MailboxTexture::MailboxTexture(const gpu::MailboxHolder &mailboxHolder, const QS
         m_textureSize = QSize(1, 1);
 }
 
+MailboxTexture::~MailboxTexture()
+{
+#if defined(USE_X11)
+   // This is rare case, where context is not shared
+   // we created extra texture in current context, so
+   // delete it now
+   if (m_ownsTexture) {
+       QOpenGLContext *currentContext = QOpenGLContext::currentContext() ;
+       QOpenGLFunctions *funcs = currentContext->functions();
+       GLuint id(m_textureId);
+       funcs->glDeleteTextures(1, &id);
+   }
+#endif
+}
+
 void MailboxTexture::bind()
 {
     glBindTexture(m_target, m_textureId);
@@ -401,8 +422,25 @@ RectClipNode::RectClipNode(const QRectF &rect)
 
 DelegatedFrameNode::DelegatedFrameNode()
     : m_numPendingSyncPoints(0)
+#if defined(USE_X11)
+    , m_contextShared(true)
+#endif
 {
     setFlag(UsePreprocess);
+#if defined(USE_X11)
+    QOpenGLContext *currentContext = QOpenGLContext::currentContext() ;
+    QOpenGLContext *sharedContext = qt_gl_global_share_context();
+    if (!QOpenGLContext::areSharing(currentContext, sharedContext)) {
+        static bool allowNotSharedContextWarningShown = true;
+        if (allowNotSharedContextWarningShown) {
+            allowNotSharedContextWarningShown = false;
+            qWarning("Context is not shared, textures will be copied between contexts.");
+        }
+        m_offsurface.reset(new QOffscreenSurface);
+        m_offsurface->create();
+        m_contextShared = false;
+    }
+#endif
 }
 
 DelegatedFrameNode::~DelegatedFrameNode()
@@ -724,29 +762,28 @@ void DelegatedFrameNode::fetchAndSyncMailboxes(QList<MailboxTexture *> &mailboxe
         waitChromiumSync(&sync);
         deleteChromiumSync(&sync);
     }
+
 #if defined(USE_X11)
     // Workaround when context is not shared QTBUG-48969
     // Make slow copy between two contexts.
-    QOpenGLContext *currentContext = QOpenGLContext::currentContext() ;
-    QOpenGLContext *sharedContext = qt_gl_global_share_context();
-    if (!QOpenGLContext::areSharing(currentContext,sharedContext)) {
-        static bool allowNotSharedContextWarningShown = true;
-        if (allowNotSharedContextWarningShown) {
-            allowNotSharedContextWarningShown = false;
-            qWarning("Context is not shared, textures will be copied between contexts.");
-        }
+    if (!m_contextShared) {
+        QOpenGLContext *currentContext = QOpenGLContext::currentContext() ;
+        QOpenGLContext *sharedContext = qt_gl_global_share_context();
+
+        QSurface *surface = currentContext->surface();
+        Q_ASSERT(m_offsurface);
+        sharedContext->makeCurrent(m_offsurface.data());
+        QOpenGLFunctions *funcs = sharedContext->functions();
+
+        GLuint fbo = 0;
+        funcs->glGenFramebuffers(1, &fbo);
 
         Q_FOREACH (MailboxTexture *mailboxTexture, mailboxesToFetch) {
-            QSurface *surface = currentContext->surface();
             // Read texture into QImage from shared context.
             // Switch to shared context.
-            QOffscreenSurface offsurface;
-            offsurface.create();
-            sharedContext->makeCurrent(&offsurface);
-            QOpenGLFunctions *funcs = sharedContext->functions();
+            sharedContext->makeCurrent(m_offsurface.data());
+            funcs = sharedContext->functions();
             QImage img(mailboxTexture->textureSize(), QImage::Format_RGBA8888_Premultiplied);
-            GLuint fbo = 0;
-            funcs->glGenFramebuffers(1, &fbo);
             funcs->glBindFramebuffer(GL_FRAMEBUFFER, fbo);
             funcs->glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D, mailboxTexture->m_textureId, 0);
             GLenum status = funcs->glCheckFramebufferStatus(GL_FRAMEBUFFER);
@@ -754,13 +791,12 @@ void DelegatedFrameNode::fetchAndSyncMailboxes(QList<MailboxTexture *> &mailboxe
                 qWarning("fbo error, skipping slow copy...");
                 continue;
             }
-
-            funcs->glReadPixels(0, 0, mailboxTexture->textureSize().width(), mailboxTexture->textureSize().height(), GL_RGBA, GL_UNSIGNED_BYTE, img.bits());
-            funcs->glBindFramebuffer(GL_FRAMEBUFFER, 0);
+            funcs->glReadPixels(0, 0, mailboxTexture->textureSize().width(), mailboxTexture->textureSize().height(),
+                                GL_RGBA, GL_UNSIGNED_BYTE, img.bits());
 
             // Restore current context.
-            currentContext->makeCurrent(surface);
             // Create texture from QImage in current context.
+            currentContext->makeCurrent(surface);
             GLuint texture = 0;
             funcs = currentContext->functions();
             funcs->glGenTextures(1, &texture);
@@ -772,7 +808,14 @@ void DelegatedFrameNode::fetchAndSyncMailboxes(QList<MailboxTexture *> &mailboxe
             funcs->glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, mailboxTexture->textureSize().width(), mailboxTexture->textureSize().height(), 0,
                                 GL_RGBA, GL_UNSIGNED_BYTE, img.bits());
             mailboxTexture->m_textureId = texture;
+            mailboxTexture->m_ownsTexture = true;
         }
+        // Cleanup allocated resources
+        sharedContext->makeCurrent(m_offsurface.data());
+        funcs = sharedContext->functions();
+        funcs->glBindFramebuffer(GL_FRAMEBUFFER, 0);
+        funcs->glDeleteFramebuffers(1, &fbo);
+        currentContext->makeCurrent(surface);
     }
 #endif
 }
diff --git a/src/core/delegated_frame_node.h b/src/core/delegated_frame_node.h
index e2a3804e3..36ec20f1d 100644
--- a/src/core/delegated_frame_node.h
+++ b/src/core/delegated_frame_node.h
@@ -49,6 +49,7 @@
 #include <QSharedData>
 #include <QSharedPointer>
 #include <QWaitCondition>
+#include <QtGui/QOffscreenSurface>
 
 #include "chromium_gpu_helper.h"
 #include "render_widget_host_view_qt_delegate.h"
@@ -104,6 +105,10 @@ private:
     QMutex m_mutex;
     QList<gl::TransferableFence> m_textureFences;
     std::unique_ptr<gpu::SyncPointClient> m_syncPointClient;
+#if defined(USE_X11)
+    bool m_contextShared;
+    QScopedPointer<QOffscreenSurface> m_offsurface;
+#endif
 };
 
 } // namespace QtWebEngineCore
diff --git a/src/core/gyp_run.pro b/src/core/gyp_run.pro
index 7014adbf7..9f2a44d7b 100644
--- a/src/core/gyp_run.pro
+++ b/src/core/gyp_run.pro
@@ -19,7 +19,7 @@ cross_compile {
 GYP_CONFIG += qtwe_process_name_debug=$$QTWEBENGINEPROCESS_NAME_DEBUG
 GYP_CONFIG += qtwe_process_name_release=$$QTWEBENGINEPROCESS_NAME_RELEASE
 GYP_CONFIG += disable_glibcxx_debug=1
-!contains(QT_CONFIG, no-pkg-config): GYP_CONFIG += pkg-config=$$pkgConfigExecutable()
+!contains(QT_CONFIG, no-pkg-config): GYP_ARGS += "-D pkg-config=\"$$pkgConfigExecutable()\""
 
 !webcore_debug: GYP_CONFIG += remove_webcore_debug_symbols=1
 !v8base_debug: GYP_CONFIG += remove_v8base_debug_symbols=1
@@ -82,6 +82,10 @@ contains(QT_ARCH, "arm") {
         contains(MFPU, "neon")|contains(MFPU, "neon-vfpv4"): GYP_CONFIG += arm_fpu=\"$$MFPU\" arm_neon=1
         else:!lessThan(MARMV, 7): GYP_CONFIG += arm_neon=0 arm_neon_optional=1
         else: GYP_CONFIG += arm_fpu=\"$$MFPU\" arm_neon=0 arm_neon_optional=0
+    } else {
+        # Chromium defaults to arm_neon=1, Qt does not.
+        GYP_CONFIG += arm_neon=0
+        !lessThan(MARMV, 7): GYP_CONFIG += arm_neon_optional=1
     }
 
     contains(QMAKE_CFLAGS, "-marm"): GYP_CONFIG += arm_thumb=0
diff --git a/src/core/user_resource_controller_host.cpp b/src/core/user_resource_controller_host.cpp
index b2de41cc0..9d2ba8eb8 100644
--- a/src/core/user_resource_controller_host.cpp
+++ b/src/core/user_resource_controller_host.cpp
@@ -81,7 +81,8 @@ void UserResourceControllerHost::WebContentsObserverHelper::RenderViewCreated(co
 void UserResourceControllerHost::WebContentsObserverHelper::RenderViewHostChanged(content::RenderViewHost *oldHost,
                                                                                 content::RenderViewHost *newHost)
 {
-    oldHost->Send(new RenderViewObserverHelper_ClearScripts(oldHost->GetRoutingID()));
+    if (oldHost)
+        oldHost->Send(new RenderViewObserverHelper_ClearScripts(oldHost->GetRoutingID()));
 
     content::WebContents *contents = web_contents();
     Q_FOREACH (const UserScript &script, m_controllerHost->m_perContentsScripts.value(contents))
diff --git a/src/core/web_contents_delegate_qt.cpp b/src/core/web_contents_delegate_qt.cpp
index 144cb0f19..9d0965818 100644
--- a/src/core/web_contents_delegate_qt.cpp
+++ b/src/core/web_contents_delegate_qt.cpp
@@ -104,6 +104,7 @@ content::WebContents *WebContentsDelegateQt::OpenURLFromTab(content::WebContents
         if (targetAdapter)
             target = targetAdapter->webContents();
     }
+    Q_ASSERT(target);
 
     content::NavigationController::LoadURLParams load_url_params(params.url);
     load_url_params.referrer = params.referrer;
diff --git a/src/plugins/qwebengineview/qwebengineview_plugin.cpp b/src/plugins/qwebengineview/qwebengineview_plugin.cpp
index 2d331571b..c885816c5 100644
--- a/src/plugins/qwebengineview/qwebengineview_plugin.cpp
+++ b/src/plugins/qwebengineview/qwebengineview_plugin.cpp
@@ -91,7 +91,9 @@ bool QWebEngineViewPlugin::isContainer() const
 
 QWidget *QWebEngineViewPlugin::createWidget(QWidget *parent)
 {
-    return new QWebEngineView(parent);
+    if (parent)
+        return new QWebEngineView(parent);
+    return new fake::QWebEngineView;
 }
 
 bool QWebEngineViewPlugin::isInitialized() const
diff --git a/src/plugins/qwebengineview/qwebengineview_plugin.h b/src/plugins/qwebengineview/qwebengineview_plugin.h
index 8fa94625c..7c6f02e2a 100644
--- a/src/plugins/qwebengineview/qwebengineview_plugin.h
+++ b/src/plugins/qwebengineview/qwebengineview_plugin.h
@@ -38,9 +38,43 @@
 #define QWEBENGINEVIEW_PLUGIN_H
 
 #include <QtUiPlugin/QDesignerCustomWidgetInterface>
+#include <QtWidgets/QWidget>
+#include <QtGui/QIcon>
+#include <QtCore/QUrl>
 
 QT_BEGIN_NAMESPACE
 
+namespace fake {
+// A lightweight "fake" QWebEngineView class that is returned when Qt Designer
+// queries the default property values by calling
+// QDesignerCustomWidgetInterface::createWidget() with 0 parent, preventing
+// crashes during QWebEngine initialization (QTBUG-53984).
+// The property list needs to be kept in sync with QWebEngineView.
+class QWebEngineView : public QWidget {
+    Q_OBJECT
+    Q_PROPERTY(QString title READ title)
+    Q_PROPERTY(QUrl url READ url WRITE setUrl) // Designable
+    Q_PROPERTY(QUrl iconUrl READ iconUrl)
+    Q_PROPERTY(QIcon icon READ icon)
+    Q_PROPERTY(QString selectedText READ selectedText)
+    Q_PROPERTY(bool hasSelection READ hasSelection)
+    Q_PROPERTY(qreal zoomFactor READ zoomFactor WRITE setZoomFactor) // Designable
+
+public:
+    explicit QWebEngineView(QWidget *parent = Q_NULLPTR) : QWidget(parent) {}
+
+    QString title() const { return QString(); }
+    QUrl url() const { return QUrl(); }
+    void setUrl(const QUrl &) {}
+    QUrl iconUrl() const { return QUrl(); }
+    QIcon icon() const { return QIcon(); }
+    QString selectedText() { return QString(); }
+    bool hasSelection() { return false; }
+    qreal zoomFactor() const { return 1; }
+    void setZoomFactor(qreal) {}
+};
+} // namespace fake
+
 class QWebEngineViewPlugin: public QObject, public QDesignerCustomWidgetInterface
 {
     Q_OBJECT
diff --git a/src/webengine/api/qquickwebenginescript.cpp b/src/webengine/api/qquickwebenginescript.cpp
index b9517ee7c..8ec5d1fe7 100644
--- a/src/webengine/api/qquickwebenginescript.cpp
+++ b/src/webengine/api/qquickwebenginescript.cpp
@@ -106,7 +106,7 @@ QString QQuickWebEngineScript::toString() const
 }
 
 /*!
-    \qmlproperty QString WebEngineScript::name
+    \qmlproperty string WebEngineScript::name
 
     The name of the script. Can be useful to retrieve a particular script from
     \l{WebEngineView::userScripts}{WebEngineView.userScripts}.
diff --git a/src/webengine/api/qquickwebenginesettings.cpp b/src/webengine/api/qquickwebenginesettings.cpp
index 87b0b0422..7aa4d2a96 100644
--- a/src/webengine/api/qquickwebenginesettings.cpp
+++ b/src/webengine/api/qquickwebenginesettings.cpp
@@ -99,7 +99,7 @@ bool QQuickWebEngineSettings::javascriptEnabled() const
 /*!
     \qmlproperty bool WebEngineSettings::javascriptCanOpenWindows
 
-    Allows JavaScript programs to open new windows.
+    Allows JavaScript programs to open popup windows without user interaction.
 
     Enabled by default.
 */
diff --git a/src/webengine/doc/src/webengineview.qdoc b/src/webengine/doc/src/webengineview.qdoc
index 4acf3eb55..82fd66989 100644
--- a/src/webengine/doc/src/webengineview.qdoc
+++ b/src/webengine/doc/src/webengineview.qdoc
@@ -346,21 +346,21 @@
 */
 
 /*!
-    \qmlproperty QSizeF WebEngineView::contentsSize
+    \qmlproperty size WebEngineView::contentsSize
     \since QtWebEngine 1.3
 
     Size of the page contents.
 */
 
 /*!
-    \qmlproperty QPointF WebEngineView::scrollPosition
+    \qmlproperty point WebEngineView::scrollPosition
     \since QtWebEngine 1.3
 
     Scroll position of the page contents.
 */
 
 /*!
-    \qmlproperty uint WebEngineView::webChannelWorld
+    \qmlproperty int WebEngineView::webChannelWorld
     \since QtWebEngine 1.3
 
     JavaScript world that the web channel instance used by this view is
@@ -804,7 +804,7 @@
            (Added in Qt 5.6)
     \value  WebEngineView.ExitFullScreen
             Exit the fullscreen mode. (Added in Qt 5.6)
-    \value  SavePage
+    \value  WebEngineView.SavePage
             Save the current web page to disk. (Added in Qt 5.7)
 
     \omitvalue WebActionCount
diff --git a/src/webengine/render_widget_host_view_qt_delegate_quick.cpp b/src/webengine/render_widget_host_view_qt_delegate_quick.cpp
index e9b8dea44..68b097d4a 100644
--- a/src/webengine/render_widget_host_view_qt_delegate_quick.cpp
+++ b/src/webengine/render_widget_host_view_qt_delegate_quick.cpp
@@ -265,7 +265,7 @@ void RenderWidgetHostViewQtDelegateQuick::mousePressEvent(QMouseEvent *event)
     QQuickItem *parent = parentItem();
     if (!m_isPopup && (parent && parent->property("activeFocusOnPress").toBool()))
         forceActiveFocus();
-    if (parent && !parent->property("activeFocusOnPress").toBool() && !parent->hasActiveFocus()) {
+    if (!m_isPopup && parent && !parent->property("activeFocusOnPress").toBool() && !parent->hasActiveFocus()) {
         event->ignore();
         return;
     }
@@ -285,7 +285,7 @@ void RenderWidgetHostViewQtDelegateQuick::mouseMoveEvent(QMouseEvent *event)
 void RenderWidgetHostViewQtDelegateQuick::mouseReleaseEvent(QMouseEvent *event)
 {
     QQuickItem *parent = parentItem();
-    if (parent && !parent->property("activeFocusOnPress").toBool() && !parent->hasActiveFocus()) {
+    if (!m_isPopup && parent && !parent->property("activeFocusOnPress").toBool() && !parent->hasActiveFocus()) {
         event->ignore();
         return;
     }
@@ -323,7 +323,7 @@ void RenderWidgetHostViewQtDelegateQuick::touchEvent(QTouchEvent *event)
 void RenderWidgetHostViewQtDelegateQuick::hoverMoveEvent(QHoverEvent *event)
 {
     QQuickItem *parent = parentItem();
-    if (parent && !parent->property("activeFocusOnPress").toBool() && !parent->hasActiveFocus()) {
+    if (!m_isPopup && parent && !parent->property("activeFocusOnPress").toBool() && !parent->hasActiveFocus()) {
         event->ignore();
         return;
     }
diff --git a/src/webenginewidgets/api/qwebenginecontextmenudata.cpp b/src/webenginewidgets/api/qwebenginecontextmenudata.cpp
index 23be32bf6..37b65403a 100644
--- a/src/webenginewidgets/api/qwebenginecontextmenudata.cpp
+++ b/src/webenginewidgets/api/qwebenginecontextmenudata.cpp
@@ -56,7 +56,7 @@ ASSERT_ENUMS_MATCH(QtWebEngineCore::WebEngineContextMenuData::MediaTypePlugin, Q
     \since 5.7
     \brief The QWebEngineContextMenuData class provides context data for populating or extending a context menu with actions.
 
-    \inmodule QtWebEngine
+    \inmodule QtWebEngineWidgets
 
     QWebEngineContextMenuData is returned by QWebEnginePage::contextMenuData() after a context menu event,
     and contains information about where the context menu event took place. This is also in the context
diff --git a/src/webenginewidgets/api/qwebenginepage.cpp b/src/webenginewidgets/api/qwebenginepage.cpp
index 37c156e17..8911b114f 100644
--- a/src/webenginewidgets/api/qwebenginepage.cpp
+++ b/src/webenginewidgets/api/qwebenginepage.cpp
@@ -299,9 +299,14 @@ void QWebEnginePagePrivate::adoptNewWindow(QSharedPointer<WebContentsAdapter> ne
     if (newPage->d_func() == this) {
         // If createWindow returns /this/ we must delay the adoption.
         Q_ASSERT(q == newPage);
-        QTimer::singleShot(0, q, [this, newPage, newWebContents, initialGeometry] () {
-            adoptNewWindowImpl(newPage, newWebContents, initialGeometry);
-        });
+        // WebContents might be null if we just opened a new page for navigation, in that case
+        // avoid referencing newWebContents so that it is deleted and WebContentsDelegateQt::OpenURLFromTab
+        // will fall back to navigating current page.
+        if (newWebContents->webContents()) {
+            QTimer::singleShot(0, q, [this, newPage, newWebContents, initialGeometry] () {
+                adoptNewWindowImpl(newPage, newWebContents, initialGeometry);
+            });
+        }
     } else {
         adoptNewWindowImpl(newPage, newWebContents, initialGeometry);
     }
diff --git a/src/webenginewidgets/doc/src/qwebenginesettings_lgpl.qdoc b/src/webenginewidgets/doc/src/qwebenginesettings_lgpl.qdoc
index b6d9d5252..955f6d80b 100644
--- a/src/webenginewidgets/doc/src/qwebenginesettings_lgpl.qdoc
+++ b/src/webenginewidgets/doc/src/qwebenginesettings_lgpl.qdoc
@@ -93,7 +93,8 @@
     \value  JavascriptEnabled
             Enables the running of JavaScript programs. Enabled by default.
     \value  JavascriptCanOpenWindows
-            Allows JavaScript programs to open new windows. Enabled by default.
+            Allows JavaScript programs to open popup windows without user
+            interaction. Enabled by default.
     \value  JavascriptCanAccessClipboard
             Allows JavaScript programs to read from and write to the clipboard. Disabled by
             default.
diff --git a/tests/auto/quick/qmltests/data/tst_scrollPosition.qml b/tests/auto/quick/qmltests/data/tst_scrollPosition.qml
index 08bb0f3b4..55b71189d 100644
--- a/tests/auto/quick/qmltests/data/tst_scrollPosition.qml
+++ b/tests/auto/quick/qmltests/data/tst_scrollPosition.qml
@@ -69,7 +69,11 @@ TestWebEngineView {
             tryCompare(webEngineView.scrollPosition, "y", 0);
 
             keyPress(Qt.Key_Return); // Focus is on the scroll button.
-            scrollPositionSpy.wait();
+
+            // Wait for proper scroll position change otherwise we cannot expect
+            // the new y position after reload.
+            tryCompare(webEngineView.scrollPosition, "x", 0);
+            tryCompare(webEngineView.scrollPosition, "y", 600);
 
             webEngineView.reload();
             verify(webEngineView.waitForLoadSucceeded());