From 1f77d4709946511b919810354f19875824399096 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=BCri=20Valdmann?= <juri.valdmann@qt.io>
Date: Mon, 18 Feb 2019 16:10:17 +0100
Subject: Fix crash on dynamic_cast in global event filter

Installing an event filter on QApplication which uses dynamic_cast will crash
the application since QtWebEngine is sending QTimerEvents to classes without
RTTI information.

Fix by

  1. Moving the QObject part of MessagePumpForUIQt into api/ as a private class.
  2. Using QTimer directly in WebEngineSettings, without subclassing.

Fixes: QTBUG-73833
Change-Id: Ida73006a4fef76637c964f8f05468adcc4a190ce
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
---
 src/core/browser_main_parts_qt.cpp | 48 +++++++++-----------------------------
 1 file changed, 11 insertions(+), 37 deletions(-)

(limited to 'src/core/browser_main_parts_qt.cpp')

diff --git a/src/core/browser_main_parts_qt.cpp b/src/core/browser_main_parts_qt.cpp
index 8f39386d4..3d85c04c4 100644
--- a/src/core/browser_main_parts_qt.cpp
+++ b/src/core/browser_main_parts_qt.cpp
@@ -39,6 +39,8 @@
 
 #include "browser_main_parts_qt.h"
 
+#include "api/qwebenginemessagepumpscheduler_p.h"
+
 #include "base/message_loop/message_loop.h"
 #include "base/process/process.h"
 #include "base/threading/thread_restrictions.h"
@@ -54,11 +56,7 @@
 #include "service/service_qt.h"
 #include "web_engine_context.h"
 
-#include <QCoreApplication>
-#include <QEvent>
 #include <QEventLoop>
-#include <QObject>
-#include <QTimerEvent>
 
 #if defined(OS_MACOSX)
 #include "ui/base/idle/idle.h"
@@ -91,16 +89,12 @@ int GetTimeIntervalMilliseconds(const base::TimeTicks &from)
     return delay < 0 ? 0 : delay;
 }
 
-class MessagePumpForUIQt : public QObject,
-                           public base::MessagePump
+class MessagePumpForUIQt : public base::MessagePump
 {
 public:
     MessagePumpForUIQt()
-        : m_delegate(nullptr)
-        , m_explicitLoop(nullptr)
-        , m_timerId(0)
-    {
-    }
+        : m_scheduler([this]() { handleScheduledWork(); })
+    {}
 
     void Run(Delegate *delegate) override
     {
@@ -123,36 +117,17 @@ public:
 
     void ScheduleWork() override
     {
+        // NOTE: This method may called from any thread at any time.
         if (!m_delegate)
             m_delegate = base::MessageLoopForUI::current();
-        QCoreApplication::postEvent(this, new QTimerEvent(0));
-        m_timerScheduledTime = base::TimeTicks::Now();
+        m_scheduler.scheduleWork();
     }
 
     void ScheduleDelayedWork(const base::TimeTicks &delayed_work_time) override
     {
         if (!m_delegate)
             m_delegate = base::MessageLoopForUI::current();
-        if (delayed_work_time.is_null()) {
-            killTimer(m_timerId);
-            m_timerId = 0;
-            m_timerScheduledTime = base::TimeTicks();
-        } else if (!m_timerId || delayed_work_time < m_timerScheduledTime) {
-            killTimer(m_timerId);
-            m_timerId = startTimer(GetTimeIntervalMilliseconds(delayed_work_time));
-            m_timerScheduledTime = delayed_work_time;
-        }
-    }
-
-protected:
-    void timerEvent(QTimerEvent *ev) override
-    {
-        Q_ASSERT(!ev->timerId() || m_timerId == ev->timerId());
-        killTimer(m_timerId);
-        m_timerId = 0;
-        m_timerScheduledTime = base::TimeTicks();
-
-        handleScheduledWork();
+        m_scheduler.scheduleDelayedWork(GetTimeIntervalMilliseconds(delayed_work_time));
     }
 
 private:
@@ -173,10 +148,9 @@ private:
         ScheduleDelayedWork(delayed_work_time);
     }
 
-    Delegate *m_delegate;
-    QEventLoop *m_explicitLoop;
-    int m_timerId;
-    base::TimeTicks m_timerScheduledTime;
+    Delegate *m_delegate = nullptr;
+    QEventLoop *m_explicitLoop = nullptr;
+    QWebEngineMessagePumpScheduler m_scheduler;
 };
 
 }  // anonymous namespace
-- 
cgit v1.2.3