Fix assert in WebContentsAdapter::devToolsFrontendDestroyed

Can be reproduced with quicknanobrowser by

  1. Open devtools
  2. Switch to OTR mode

During the switch to OTR mode, the inspected WebContentsAdapter is
destroyed and recreated. DevToolsFrontendQt is supposed to call
devToolsFrontendDestroyed on the old WebContentsAdapter, but it
accesses this adapter through QQuickWebEngineViewPrivate's
webContentsAdapter() which has already been changed to the new value,
so devToolsFrontendDestroyed is actually called on the wrong object.

Fix by remembering the WebContentsAdapter pointer in the
DevToolsFrontendQt constructor.

Change-Id: I17004ebb1a392399ef3e189c433d3f4b3f05bfd3
Reviewed-by: Tamas Zakor <ztamas@inf.u-szeged.hu>
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

2 files changed, 9 insertions, 5 deletions

diff --git a/src/core/devtools_frontend_qt.cpp b/src/core/devtools_frontend_qt.cpp
index 810c91b94..da82a46d3 100644
--- a/src/core/devtools_frontend_qt.cpp
+++ b/src/core/devtools_frontend_qt.cpp
@@ -226,7 +226,9 @@ DevToolsFrontendQt *DevToolsFrontendQt::Show(QSharedPointer<WebContentsAdapter>
 DevToolsFrontendQt::DevToolsFrontendQt(QSharedPointer<WebContentsAdapter> webContentsAdapter,
                                        content::WebContents *inspectedContents)
     : content::WebContentsObserver(webContentsAdapter->webContents())
-    , m_webContentsAdapter(webContentsAdapter)
+    , m_frontendAdapter(webContentsAdapter)
+    , m_inspectedAdapter(static_cast<WebContentsDelegateQt *>(inspectedContents->GetDelegate())
+                                 ->webContentsAdapter())
     , m_inspectedContents(inspectedContents)
     , m_inspect_element_at_x(-1)
     , m_inspect_element_at_y(-1)
@@ -246,7 +248,7 @@ DevToolsFrontendQt::DevToolsFrontendQt(QSharedPointer<WebContentsAdapter> webCon
 
 DevToolsFrontendQt::~DevToolsFrontendQt()
 {
-    if (QSharedPointer<WebContentsAdapter> p = m_webContentsAdapter)
+    if (QSharedPointer<WebContentsAdapter> p = m_frontendAdapter)
         p->setInspector(false);
 }
 
@@ -325,8 +327,8 @@ void DevToolsFrontendQt::DocumentAvailableInMainFrame()
 
 void DevToolsFrontendQt::WebContentsDestroyed()
 {
-    if (m_inspectedContents)
-        static_cast<WebContentsDelegateQt *>(m_inspectedContents->GetDelegate())->webContentsAdapter()->devToolsFrontendDestroyed(this);
+    if (m_inspectedAdapter)
+        m_inspectedAdapter->devToolsFrontendDestroyed(this);
 
     if (m_agentHost) {
         m_agentHost->DetachClient(this);
@@ -594,6 +596,7 @@ void DevToolsFrontendQt::AgentHostClosed(content::DevToolsAgentHost *agentHost)
     DCHECK(agentHost == m_agentHost.get());
     m_agentHost = nullptr;
     m_inspectedContents = nullptr;
+    m_inspectedAdapter = nullptr;
     Close();
 }
 
diff --git a/src/core/devtools_frontend_qt.h b/src/core/devtools_frontend_qt.h
index 9fefcb435..423131c4e 100644
--- a/src/core/devtools_frontend_qt.h
+++ b/src/core/devtools_frontend_qt.h
@@ -115,7 +115,8 @@ private:
     void CreateJsonPreferences(bool clear);
 
     // We shouldn't be keeping it alive
-    QWeakPointer<WebContentsAdapter> m_webContentsAdapter;
+    QWeakPointer<WebContentsAdapter> m_frontendAdapter;
+    WebContentsAdapter *m_inspectedAdapter;
     WebContentsDelegateQt *m_frontendDelegate;
     content::WebContents *m_inspectedContents;
     scoped_refptr<content::DevToolsAgentHost> m_agentHost;