Fix access to deleted memory on QWebEnginePage destruction

Suppose QWebEnginePage is destroyed while there's still a combobox popup
open. We would crash with the following stack trace:

1   QtWebEngineCore::RenderWidgetHostViewQt::dpiScale
2   QtWebEngineCore::RenderWidgetHostViewQt::GetViewBounds
3   content::RenderWidgetHostImpl::SendScreenRects
4   content::RenderWidgetHostImpl::OnRenderViewReady
...
16  base::MessageLoop::DoWork
17  WebEngineContext::destroy
18  `anonymous namespace'::destroyContext
19  qt_call_post_routines
20  QApplication::~QApplication

RenderWidgetHostViewQt still holds a pointer to WebContentsAdapterClient.
To fix this, expose the QObject owning the adapter client, and
hide RenderWidgetHostViewQt when it is destroyed so it won't try to render.

Change-Id: Ide5543197b35038a3e1c7491ceda3f5ad10f6f07
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

1 files changed, 6 insertions, 0 deletions

diff --git a/src/webengine/api/qquickwebengineview.cpp b/src/webengine/api/qquickwebengineview.cpp
index f0458b869..357f95bc4 100644
--- a/src/webengine/api/qquickwebengineview.cpp
+++ b/src/webengine/api/qquickwebengineview.cpp
@@ -628,6 +628,12 @@ WebEngineSettings *QQuickWebEngineViewPrivate::webEngineSettings() const
     return m_settings->d_ptr.data();
 }
 
+const QObject *QQuickWebEngineViewPrivate::holdingQObject() const
+{
+    Q_Q(const QQuickWebEngineView);
+    return q;
+}
+
 void QQuickWebEngineViewPrivate::setDevicePixelRatio(qreal devicePixelRatio)
 {
     Q_Q(QQuickWebEngineView);