From 9ef3a8263098c6a32db8b824aabf85587d1f1140 Mon Sep 17 00:00:00 2001
From: Allan Sandfeld Jensen <allan.jensen@qt.io>
Date: Thu, 16 Nov 2017 14:36:33 +0100
Subject: Fix access after free on shutdown

After we keep around the browser-context after the profile is deleted
it was keeping pointers to deleted objects and would sometimes use them
on shutdown.

Change-Id: Ib67d0ee0b27cb1a1b64d9b8b4c348ed418b9bbc3
Reviewed-by: Peter Varga <pvarga@inf.u-szeged.hu>
Reviewed-by: Michal Klocek <michal.klocek@qt.io>
---
 src/webenginewidgets/api/qwebengineprofile.cpp | 9 +++++++++
 1 file changed, 9 insertions(+)

(limited to 'src/webenginewidgets/api/qwebengineprofile.cpp')

diff --git a/src/webenginewidgets/api/qwebengineprofile.cpp b/src/webenginewidgets/api/qwebengineprofile.cpp
index f120ae51e..e1e72aa45 100644
--- a/src/webenginewidgets/api/qwebengineprofile.cpp
+++ b/src/webenginewidgets/api/qwebengineprofile.cpp
@@ -154,12 +154,19 @@ QWebEngineBrowserContext::QWebEngineBrowserContext(QSharedPointer<QtWebEngineCor
 }
 
 QWebEngineBrowserContext::~QWebEngineBrowserContext()
+{
+    if (m_profile)
+        shutdown();
+}
+
+void QWebEngineBrowserContext::shutdown()
 {
     Q_ASSERT(m_profile);
     // In the case the user sets this profile as the parent of the interceptor
     // it can be deleted before the browser-context still referencing it is.
     browserContextRef->setRequestInterceptor(nullptr);
     browserContextRef->removeClient(m_profile);
+    m_profile = 0;
 }
 
 QWebEngineProfilePrivate::QWebEngineProfilePrivate(QSharedPointer<QtWebEngineCore::BrowserContextAdapter> browserContext)
@@ -181,6 +188,8 @@ QWebEngineProfilePrivate::~QWebEngineProfilePrivate()
     }
 
     m_ongoingDownloads.clear();
+    if (m_browserContext)
+        m_browserContext->shutdown();
 }
 
 QSharedPointer<QtWebEngineCore::BrowserContextAdapter> QWebEngineProfilePrivate::browserContext() const
-- 
cgit v1.2.3