Skip to content

Commit c1ae43b

Browse files
committed
fix crash on WebEngineNewViewRequest.openIn
When calling WebEngineNewViewRequest.openIn with the WebEngineView that initiated the request, QQuickWebEngineViewPrivate::adoptWebContents would destroy the current WebContentsAdapter object. But this WebContentsAdapter implicitly holds the RenderHostViewImpl of the current call stack. Accesses to it after adoptWebContents is finished will crash. Fix the crash by deferred deletion of the current WebContentsAdapter. Task-number: QTBUG-47601 Change-Id: I3c229172511b4aed77632a0abefbe0265ebf1557 Reviewed-by: Michael Brüning <[email protected]>
1 parent 5a8bae7 commit c1ae43b

File tree

1 file changed

+14
-0
lines changed

1 file changed

+14
-0
lines changed

src/webengine/api/qquickwebengineview.cpp

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -543,6 +543,18 @@ QAccessible::State QQuickWebEngineViewAccessible::state() const
543543
}
544544
#endif // QT_NO_ACCESSIBILITY
545545

546+
class WebContentsAdapterOwner : public QObject
547+
{
548+
public:
549+
typedef QExplicitlySharedDataPointer<QtWebEngineCore::WebContentsAdapter> AdapterPtr;
550+
WebContentsAdapterOwner(const AdapterPtr &ptr)
551+
: adapter(ptr)
552+
{}
553+
554+
private:
555+
AdapterPtr adapter;
556+
};
557+
546558
void QQuickWebEngineViewPrivate::adoptWebContents(WebContentsAdapter *webContents)
547559
{
548560
if (!webContents) {
@@ -566,6 +578,8 @@ void QQuickWebEngineViewPrivate::adoptWebContents(WebContentsAdapter *webContent
566578

567579
// This throws away the WebContentsAdapter that has been used until now.
568580
// All its states, particularly the loading URL, are replaced by the adopted WebContentsAdapter.
581+
WebContentsAdapterOwner *adapterOwner = new WebContentsAdapterOwner(adapter);
582+
adapterOwner->deleteLater();
569583
adapter = webContents;
570584
adapter->initialize(this);
571585

0 commit comments

Comments
 (0)