Invalidate accessible interfaces on destruction of view or page

The RenderWidgetHostViewQtDelegate(Widget|Quick)Accessible interfaces
are forwarding their queries to the WebEngineView. In case of widget,
the view also forwards the query to the page.

The accessible interfaces may outlive the view and page. The interfaces
are not supposed to be used after the destruction of the underlying
objects. Thus, set the RenderWidgetHostViewQtDelegate and WebEngineView
accessible interfaces invalid if the corresponding pointers are null.

Also fix querying the root accessible interface of the web page when
the render frame host is not available.

This fixes crash when
QT_LOGGING_RULES="qt.accessibility.cache.debug=true"
is set and logger tries to pretty-print QAccessibleInterfaces during
destruction.

Task-number: QTBUG-78284
Change-Id: If18af0605061fcd82d019d0042dbf1c9d3a910be
Reviewed-by: Kirill Burtsev <kirill.burtsev@qt.io>

3 files changed, 17 insertions, 1 deletions

diff --git a/src/webenginewidgets/api/qwebengineview.cpp b/src/webenginewidgets/api/qwebengineview.cpp
index a51f9b7a5..b06d99478 100644
--- a/src/webenginewidgets/api/qwebengineview.cpp
+++ b/src/webenginewidgets/api/qwebengineview.cpp
@@ -471,6 +471,17 @@ void QWebEngineView::dropEvent(QDropEvent *e)
 #endif // QT_CONFIG(draganddrop)
 
 #ifndef QT_NO_ACCESSIBILITY
+bool QWebEngineViewAccessible::isValid() const
+{
+    if (!QAccessibleWidget::isValid())
+        return false;
+
+    if (!view() || !view()->d_func() || !view()->d_func()->page || !view()->d_func()->page->d_func())
+        return false;
+
+    return true;
+}
+
 QAccessibleInterface *QWebEngineViewAccessible::focusChild() const
 {
     if (child(0) && child(0)->focusChild())
@@ -485,7 +496,7 @@ int QWebEngineViewAccessible::childCount() const
 
 QAccessibleInterface *QWebEngineViewAccessible::child(int index) const
 {
-    if (index == 0 && view() && view()->page())
+    if (index == 0 && isValid())
         return view()->page()->d_func()->adapter->browserAccessible();
     return nullptr;
 }
diff --git a/src/webenginewidgets/api/qwebengineview.h b/src/webenginewidgets/api/qwebengineview.h
index 63a68f46c..04c8ece74 100644
--- a/src/webenginewidgets/api/qwebengineview.h
+++ b/src/webenginewidgets/api/qwebengineview.h
@@ -53,6 +53,7 @@ class QContextMenuEvent;
 class QUrl;
 class QWebEnginePage;
 class QWebEngineSettings;
+class QWebEngineViewAccessible;
 class QWebEngineViewPrivate;
 
 class QWEBENGINEWIDGETS_EXPORT QWebEngineView : public QWidget {
@@ -141,6 +142,9 @@ private:
 
     friend class QWebEnginePage;
     friend class QWebEnginePagePrivate;
+#if QT_CONFIG(accessibility)
+    friend class QWebEngineViewAccessible;
+#endif
 };
 
 QT_END_NAMESPACE
diff --git a/src/webenginewidgets/api/qwebengineview_p.h b/src/webenginewidgets/api/qwebengineview_p.h
index dd0a5bedf..a3c619cea 100644
--- a/src/webenginewidgets/api/qwebengineview_p.h
+++ b/src/webenginewidgets/api/qwebengineview_p.h
@@ -87,6 +87,7 @@ public:
     QWebEngineViewAccessible(QWebEngineView *o) : QAccessibleWidget(o)
     {}
 
+    bool isValid() const override;
     QAccessibleInterface *focusChild() const override;
     int childCount() const override;
     QAccessibleInterface *child(int index) const override;