[Qt] Fix a crash under ~PingLoader when the QNAM on the page has been destroyed.

https://bugs.webkit.org/show_bug.cgi?id=116035
Reviewed by Simon Hausmann.

Source/WebCore:

Reproduced with arora which does destroy the QNetworkAccessManager in some situations.
The problem is that PingLoader can still be pending meanwhile, holding a ResourceHandle
with a dangling pointer to a QNetworkReply destroyed with the QNetworkAccessManager.

* platform/network/qt/QNetworkReplyHandler.cpp:
(WebCore::QNetworkReplyWrapper::QNetworkReplyWrapper):
  Set the parent to 0 like we did before the introduction of QNetworkReplyWrapper.
(WebCore::QNetworkReplyWrapper::release):

Source/WebKit/qt:

* tests/qwebpage/tst_qwebpage.cpp:
(tst_QWebPage::networkReplyParentChanged):

Change-Id: Id53db216a6252f8471d6fa97093312843213e48d
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@150057 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@digia.com>

2 files changed, 18 insertions, 1 deletions

diff --git a/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp b/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
index 904e85983..b763cc28f 100644
--- a/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
+++ b/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
@@ -268,6 +268,9 @@ QNetworkReplyWrapper::QNetworkReplyWrapper(QNetworkReplyHandlerCallQueue* queue,
 {
     Q_ASSERT(m_reply);
 
+    // Allow the QNetworkReply to outlive its parent QNetworkAccessManager in case the later gets destroyed before our ResourceHandle is done with it.
+    m_reply->setParent(0);
+
     // setFinished() must be the first that we connect, so isFinished() is updated when running other slots.
     connect(m_reply, SIGNAL(finished()), this, SLOT(setFinished()));
     connect(m_reply, SIGNAL(finished()), this, SLOT(receiveMetaData()));
@@ -291,7 +294,6 @@ QNetworkReply* QNetworkReplyWrapper::release()
     m_reply = 0;
     m_sniffer = nullptr;
 
-    reply->setParent(0);
     return reply;
 }
 
diff --git a/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp b/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
index fbba56d6c..4f7b36c21 100644
--- a/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
+++ b/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
@@ -38,6 +38,7 @@
 #include <qgraphicsview.h>
 #include <qgraphicswebview.h>
 #include <qnetworkcookiejar.h>
+#include <qnetworkreply.h>
 #include <qnetworkrequest.h>
 #include <qpa/qplatforminputcontext.h>
 #include <qwebdatabase.h>
@@ -173,6 +174,7 @@ private Q_SLOTS:
 #endif
 
     void originatingObjectInNetworkRequests();
+    void networkReplyParentChanged();
     void testJSPrompt();
     void showModalDialog();
     void testStopScheduledPageRefresh();
@@ -2846,6 +2848,19 @@ void tst_QWebPage::originatingObjectInNetworkRequests()
         QVERIFY(qobject_cast<QWebFrame*>(networkManager->requests.at(i).originatingObject()) == childFrames.at(i));
 }
 
+void tst_QWebPage::networkReplyParentChanged()
+{
+    TestNetworkManager* networkManager = new TestNetworkManager(m_page);
+    m_page->setNetworkAccessManager(networkManager);
+    networkManager->requests.clear();
+
+    // Trigger a load and check if pending QNetworkReplies have been reparented before returning to the event loop.
+    m_view->load(QUrl("qrc:///resources/content.html"));
+
+    QVERIFY(networkManager->requests.count() > 0);
+    QVERIFY(networkManager->findChildren<QNetworkReply*>().isEmpty());
+}
+
 /**
  * Test fixups for https://bugs.webkit.org/show_bug.cgi?id=30914
  *