From d5cde6f1b4f7a8a2cfd4a9dbdf63cd2e2502c000 Mon Sep 17 00:00:00 2001 From: Joerg Bornemann Date: Wed, 15 Jun 2016 10:42:05 +0200 Subject: Fix access to deleted memory on QWebEnginePage destruction Suppose QWebEnginePage is destroyed while there's still a combobox popup open. We would crash with the following stack trace: 1 QtWebEngineCore::RenderWidgetHostViewQt::dpiScale 2 QtWebEngineCore::RenderWidgetHostViewQt::GetViewBounds 3 content::RenderWidgetHostImpl::SendScreenRects 4 content::RenderWidgetHostImpl::OnRenderViewReady ... 16 base::MessageLoop::DoWork 17 WebEngineContext::destroy 18 `anonymous namespace'::destroyContext 19 qt_call_post_routines 20 QApplication::~QApplication RenderWidgetHostViewQt still holds a pointer to WebContentsAdapterClient. To fix this, expose the QObject owning the adapter client, and hide RenderWidgetHostViewQt when it is destroyed so it won't try to render. Change-Id: Ide5543197b35038a3e1c7491ceda3f5ad10f6f07 Reviewed-by: Allan Sandfeld Jensen --- src/core/web_contents_adapter_client.h | 1 + 1 file changed, 1 insertion(+) (limited to 'src/core/web_contents_adapter_client.h') diff --git a/src/core/web_contents_adapter_client.h b/src/core/web_contents_adapter_client.h index e6d25a8fb..f0927c9e5 100644 --- a/src/core/web_contents_adapter_client.h +++ b/src/core/web_contents_adapter_client.h @@ -240,6 +240,7 @@ public: virtual void requestGeometryChange(const QRect &geometry) = 0; virtual void allowCertificateError(const QSharedPointer &errorController) = 0; virtual bool isEnabled() const = 0; + virtual const QObject *holdingQObject() const = 0; virtual QSharedPointer browserContextAdapter() = 0; -- cgit v1.2.3