Fix access to deleted memory on QWebEnginePage destruction

Suppose QWebEnginePage is destroyed while there's still a combobox popup
open. We would crash with the following stack trace:

1   QtWebEngineCore::RenderWidgetHostViewQt::dpiScale
2   QtWebEngineCore::RenderWidgetHostViewQt::GetViewBounds
3   content::RenderWidgetHostImpl::SendScreenRects
4   content::RenderWidgetHostImpl::OnRenderViewReady
...
16  base::MessageLoop::DoWork
17  WebEngineContext::destroy
18  `anonymous namespace'::destroyContext
19  qt_call_post_routines
20  QApplication::~QApplication

RenderWidgetHostViewQt still holds a pointer to WebContentsAdapterClient.
To fix this, expose the QObject owning the adapter client, and
hide RenderWidgetHostViewQt when it is destroyed so it won't try to render.

Change-Id: Ide5543197b35038a3e1c7491ceda3f5ad10f6f07
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

1 files changed, 1 insertions, 0 deletions

diff --git a/src/webenginewidgets/api/qwebenginepage_p.h b/src/webenginewidgets/api/qwebenginepage_p.h
index 8e5be51d0..7b16ed667 100644
--- a/src/webenginewidgets/api/qwebenginepage_p.h
+++ b/src/webenginewidgets/api/qwebenginepage_p.h
@@ -125,6 +125,7 @@ public:
                                      int exitCode) Q_DECL_OVERRIDE;
     virtual void requestGeometryChange(const QRect &geometry) Q_DECL_OVERRIDE;
     virtual bool isEnabled() const Q_DECL_OVERRIDE;
+    const QObject *holdingQObject() const Q_DECL_OVERRIDE;
 
     virtual QSharedPointer<QtWebEngineCore::BrowserContextAdapter> browserContextAdapter() Q_DECL_OVERRIDE;