Prevent accessing d when view closed during DnD operation

When a WebEngineView is closed while a Drag-n-Drop operation
is in progress, the this pointer and its d-pointer become
invalid, so the accesses after drag->exec must be prevented
from being executed. To achieve this, a lambda function is
connected to dragSources &QObject::destroyed signal, which
invalidates a bool on the stack (and cancels the Drag-n-Drop
operation).

Task-number: QTBUG-57713
Change-Id: I9cbb5e6aba99e307d62773bc18f4fec5f79cf703
Reviewed-by: Joerg Bornemann <joerg.bornemann@qt.io>

1 files changed, 15 insertions, 3 deletions

diff --git a/src/core/web_contents_adapter.cpp b/src/core/web_contents_adapter.cpp
index cafaad93d..91e457726 100644
--- a/src/core/web_contents_adapter.cpp
+++ b/src/core/web_contents_adapter.cpp
@@ -1108,6 +1108,12 @@ void WebContentsAdapter::startDragging(QObject *dragSource, const content::DropD
 
     d->currentDropAction = Qt::IgnoreAction;
     QDrag *drag = new QDrag(dragSource);    // will be deleted by Qt's DnD implementation
+    bool dValid = true;
+    QMetaObject::Connection onDestroyed = QObject::connect(dragSource, &QObject::destroyed, [&dValid](){
+        dValid = false;
+        QDrag::cancel();
+    });
+
     drag->setMimeData(mimeDataFromDropData(*d->currentDropData));
     if (!pixmap.isNull()) {
         drag->setPixmap(pixmap);
@@ -1119,9 +1125,15 @@ void WebContentsAdapter::startDragging(QObject *dragSource, const content::DropD
         drag->exec(allowedActions);
     }
 
-    content::RenderViewHost *rvh = d->webContents->GetRenderViewHost();
-    rvh->DragSourceSystemDragEnded();
-    d->currentDropData.reset();
+    QObject::disconnect(onDestroyed);
+    if (dValid) {
+        if (d->webContents) {
+            content::RenderViewHost *rvh = d->webContents->GetRenderViewHost();
+            if (rvh)
+                rvh->DragSourceSystemDragEnded();
+        }
+        d->currentDropData.reset();
+    }
 }
 
 static blink::WebDragOperationsMask toWeb(const Qt::DropActions action)