From fc077552673e25c580592047369acbe47f4be46d Mon Sep 17 00:00:00 2001
From: Allan Sandfeld Jensen <allan.jensen@qt.io>
Date: Fri, 3 May 2019 10:45:54 +0200
Subject: Do not crash on QWebEnginePagePrivate::releaseProfile()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Deregistering the widget or deleting the view should be able to handle
a now missing d_ptr in the old page.

Change-Id: Ic843f7bde12776b6aad4fad865ccf14a25695154
Fixes: QTBUG-75547
Reviewed-by: Jüri Valdmann <juri.valdmann@qt.io>
---
 src/webenginewidgets/api/qwebenginepage.cpp           | 14 +++++++++-----
 .../qwebengineprofile/tst_qwebengineprofile.cpp       | 19 +++++++++++++++++++
 2 files changed, 28 insertions(+), 5 deletions(-)

diff --git a/src/webenginewidgets/api/qwebenginepage.cpp b/src/webenginewidgets/api/qwebenginepage.cpp
index 54006169e..c33034015 100644
--- a/src/webenginewidgets/api/qwebenginepage.cpp
+++ b/src/webenginewidgets/api/qwebenginepage.cpp
@@ -762,7 +762,8 @@ void QWebEnginePagePrivate::bindPageAndView(QWebEnginePage *page, QWebEngineView
 
     if (view && oldPage != page) {
         if (oldPage) {
-            oldPage->d_func()->view = nullptr;
+            if (oldPage->d_func())
+                oldPage->d_func()->view = nullptr;
             deleteOldPage = view->d_func()->m_ownsPage;
         }
         view->d_func()->m_ownsPage = ownNewPage;
@@ -772,7 +773,7 @@ void QWebEnginePagePrivate::bindPageAndView(QWebEnginePage *page, QWebEngineView
     // Then notify.
 
     auto widget = page ? page->d_func()->widget : nullptr;
-    auto oldWidget = oldPage ? oldPage->d_func()->widget : nullptr;
+    auto oldWidget = (oldPage && oldPage->d_func()) ? oldPage->d_func()->widget : nullptr;
 
     if (page && oldView != view && oldView) {
         oldView->d_func()->pageChanged(page, nullptr);
@@ -781,7 +782,10 @@ void QWebEnginePagePrivate::bindPageAndView(QWebEnginePage *page, QWebEngineView
     }
 
     if (view && oldPage != page) {
-        view->d_func()->pageChanged(oldPage, page);
+        if (oldPage && oldPage->d_func())
+            view->d_func()->pageChanged(oldPage, page);
+        else
+            view->d_func()->pageChanged(nullptr, page);
         if (oldWidget != widget)
             view->d_func()->widgetChanged(oldWidget, widget);
     }
@@ -797,7 +801,7 @@ void QWebEnginePagePrivate::bindPageAndWidget(QWebEnginePage *page, RenderWidget
     // Change pointers first.
 
     if (widget && oldPage != page) {
-        if (oldPage)
+        if (oldPage && oldPage->d_func())
             oldPage->d_func()->widget = nullptr;
         widget->m_page = page;
     }
@@ -810,7 +814,7 @@ void QWebEnginePagePrivate::bindPageAndWidget(QWebEnginePage *page, RenderWidget
 
     // Then notify.
 
-    if (widget && oldPage != page && oldPage) {
+    if (widget && oldPage != page && oldPage && oldPage->d_func()) {
         if (auto oldView = oldPage->d_func()->view)
             oldView->d_func()->widgetChanged(widget, nullptr);
     }
diff --git a/tests/auto/widgets/qwebengineprofile/tst_qwebengineprofile.cpp b/tests/auto/widgets/qwebengineprofile/tst_qwebengineprofile.cpp
index e84aacb27..2a4e2d533 100644
--- a/tests/auto/widgets/qwebengineprofile/tst_qwebengineprofile.cpp
+++ b/tests/auto/widgets/qwebengineprofile/tst_qwebengineprofile.cpp
@@ -60,6 +60,7 @@ private Q_SLOTS:
     void downloadItem();
     void changePersistentPath();
     void initiator();
+    void badDeleteOrder();
     void qtbug_72299(); // this should be the last test
 };
 
@@ -589,6 +590,24 @@ void tst_QWebEngineProfile::initiator()
     QCOMPARE(handler.initiator, QUrl());
 }
 
+void tst_QWebEngineProfile::badDeleteOrder()
+{
+    QWebEngineProfile *profile = new QWebEngineProfile();
+    QWebEngineView *view = new QWebEngineView();
+    view->resize(640, 480);
+    view->show();
+    QVERIFY(QTest::qWaitForWindowExposed(view));
+    QWebEnginePage *page = new QWebEnginePage(profile, view);
+    view->setPage(page);
+
+    QSignalSpy spyLoadFinished(page, SIGNAL(loadFinished(bool)));
+    page->setHtml(QStringLiteral("<html><body><h1>Badly handled page!</h1></body></html>"));
+    QTRY_COMPARE(spyLoadFinished.count(), 1);
+
+    delete profile;
+    delete view;
+}
+
 void tst_QWebEngineProfile::qtbug_72299()
 {
     QWebEngineView view;
-- 
cgit v1.2.3