Fix access after free on shutdown

After we keep around the browser-context after the profile is deleted
it was keeping pointers to deleted objects and would sometimes use them
on shutdown.

Change-Id: Ib67d0ee0b27cb1a1b64d9b8b4c348ed418b9bbc3
Reviewed-by: Peter Varga <pvarga@inf.u-szeged.hu>
Reviewed-by: Michal Klocek <michal.klocek@qt.io>

1 files changed, 9 insertions, 0 deletions

diff --git a/src/webenginewidgets/api/qwebengineprofile.cpp b/src/webenginewidgets/api/qwebengineprofile.cpp
index f120ae51e..e1e72aa45 100644
--- a/src/webenginewidgets/api/qwebengineprofile.cpp
+++ b/src/webenginewidgets/api/qwebengineprofile.cpp
@@ -155,11 +155,18 @@ QWebEngineBrowserContext::QWebEngineBrowserContext(QSharedPointer<QtWebEngineCor
 
 QWebEngineBrowserContext::~QWebEngineBrowserContext()
 {
+    if (m_profile)
+        shutdown();
+}
+
+void QWebEngineBrowserContext::shutdown()
+{
     Q_ASSERT(m_profile);
     // In the case the user sets this profile as the parent of the interceptor
     // it can be deleted before the browser-context still referencing it is.
     browserContextRef->setRequestInterceptor(nullptr);
     browserContextRef->removeClient(m_profile);
+    m_profile = 0;
 }
 
 QWebEngineProfilePrivate::QWebEngineProfilePrivate(QSharedPointer<QtWebEngineCore::BrowserContextAdapter> browserContext)
@@ -181,6 +188,8 @@ QWebEngineProfilePrivate::~QWebEngineProfilePrivate()
     }
 
     m_ongoingDownloads.clear();
+    if (m_browserContext)
+        m_browserContext->shutdown();
 }
 
 QSharedPointer<QtWebEngineCore::BrowserContextAdapter> QWebEngineProfilePrivate::browserContext() const