From c1ae43bbf402ffd4c39218471508ed8477e66254 Mon Sep 17 00:00:00 2001
From: Joerg Bornemann <joerg.bornemann@theqtcompany.com>
Date: Tue, 24 Nov 2015 14:18:28 +0100
Subject: fix crash on WebEngineNewViewRequest.openIn
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When calling WebEngineNewViewRequest.openIn with the WebEngineView
that initiated the request, QQuickWebEngineViewPrivate::adoptWebContents
would destroy the current WebContentsAdapter object.
But this WebContentsAdapter implicitly holds the RenderHostViewImpl of
the current call stack. Accesses to it after adoptWebContents is finished
will crash.
Fix the crash by deferred deletion of the current WebContentsAdapter.

Task-number: QTBUG-47601
Change-Id: I3c229172511b4aed77632a0abefbe0265ebf1557
Reviewed-by: Michael Brüning <michael.bruning@theqtcompany.com>
---
 src/webengine/api/qquickwebengineview.cpp | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

(limited to 'src')

diff --git a/src/webengine/api/qquickwebengineview.cpp b/src/webengine/api/qquickwebengineview.cpp
index d262c38c8..c35b7aeb8 100644
--- a/src/webengine/api/qquickwebengineview.cpp
+++ b/src/webengine/api/qquickwebengineview.cpp
@@ -543,6 +543,18 @@ QAccessible::State QQuickWebEngineViewAccessible::state() const
 }
 #endif // QT_NO_ACCESSIBILITY
 
+class WebContentsAdapterOwner : public QObject
+{
+public:
+    typedef QExplicitlySharedDataPointer<QtWebEngineCore::WebContentsAdapter> AdapterPtr;
+    WebContentsAdapterOwner(const AdapterPtr &ptr)
+        : adapter(ptr)
+    {}
+
+private:
+    AdapterPtr adapter;
+};
+
 void QQuickWebEngineViewPrivate::adoptWebContents(WebContentsAdapter *webContents)
 {
     if (!webContents) {
@@ -566,6 +578,8 @@ void QQuickWebEngineViewPrivate::adoptWebContents(WebContentsAdapter *webContent
 
     // This throws away the WebContentsAdapter that has been used until now.
     // All its states, particularly the loading URL, are replaced by the adopted WebContentsAdapter.
+    WebContentsAdapterOwner *adapterOwner = new WebContentsAdapterOwner(adapter);
+    adapterOwner->deleteLater();
     adapter = webContents;
     adapter->initialize(this);
 
-- 
cgit v1.2.3


From 754edb8dadb9b3086f67eadabdde9659dfcb7caf Mon Sep 17 00:00:00 2001
From: Michael Bruning <michael.bruning@theqtcompany.com>
Date: Tue, 24 Nov 2015 17:09:50 +0100
Subject: Reassociate the web channel when setting a profile.

The WebContentsAdapter gets recreated and the QmlWebChannel needs to be
reassociated with the new adapter instance.

Change-Id: I88494fd379c429f2ae98df95a22c04c334452088
Task-number: QTBUG-49521
Reviewed-by: Kai Koehne <kai.koehne@theqtcompany.com>
---
 src/webengine/api/qquickwebengineview.cpp | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'src')

diff --git a/src/webengine/api/qquickwebengineview.cpp b/src/webengine/api/qquickwebengineview.cpp
index c35b7aeb8..c323f486b 100644
--- a/src/webengine/api/qquickwebengineview.cpp
+++ b/src/webengine/api/qquickwebengineview.cpp
@@ -763,8 +763,12 @@ void QQuickWebEngineViewPrivate::setProfile(QQuickWebEngineProfile *profile)
     if (adapter && adapter->browserContext() != browserContextAdapter()->browserContext()) {
         // When the profile changes we need to create a new WebContentAdapter and reload the active URL.
         QUrl activeUrl = adapter->activeUrl();
+        QQmlWebChannel *qmlWebChannel = qobject_cast<QQmlWebChannel *>(adapter->webChannel());
         adapter = 0;
         ensureContentsAdapter();
+        if (qmlWebChannel)
+            adapter->setWebChannel(qmlWebChannel);
+
         if (!explicitUrl.isValid() && activeUrl.isValid())
             adapter->load(activeUrl);
     }
-- 
cgit v1.2.3