[Qt] Fix a crash under ~PingLoader when the QNAM on the page has been destroyed.

https://bugs.webkit.org/show_bug.cgi?id=116035
Reviewed by Allan Sandfeld Jensen.

Source/WebCore:

The previous fix only moved the crash location from WebKit down to QNetworkReplyHttpImpl
which expects its QNetworkAccessManager to still be alive.

Fix it by watching the QNetworkReply's destroyed() signal and avoid the dangling pointer
instead. The QNetworkReply doesn't need to be aborted in this case anyway.

* platform/network/qt/QNetworkReplyHandler.cpp:
(WebCore::QNetworkReplyWrapper::QNetworkReplyWrapper):
(WebCore::QNetworkReplyWrapper::release):
(WebCore::QNetworkReplyWrapper::stopForwarding):
  Rename resetConnections to stopForwarding since not all connections are related
  to data forwarding to the client anymore.
(WebCore::QNetworkReplyWrapper::receiveMetaData):
(WebCore::QNetworkReplyWrapper::replyDestroyed):
(WebCore::QNetworkReplyWrapper::didReceiveFinished):
* platform/network/qt/QNetworkReplyHandler.h:
(QNetworkReplyWrapper):

Source/WebKit/qt:

* tests/qwebpage/tst_qwebpage.cpp:
(tst_QWebPage::networkReplyParentDidntChange): Change test to match the new expectation.
(tst_QWebPage::destroyQNAMBeforeAbortDoesntCrash):

Change-Id: I5e82b8ccc8fccf496669af8de76888e367480f67
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@150120 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@digia.com>

1 files changed, 18 insertions, 4 deletions

diff --git a/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp b/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
index 4f7b36c21..e5abf6b79 100644
--- a/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
+++ b/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
@@ -174,7 +174,8 @@ private Q_SLOTS:
 #endif
 
     void originatingObjectInNetworkRequests();
-    void networkReplyParentChanged();
+    void networkReplyParentDidntChange();
+    void destroyQNAMBeforeAbortDoesntCrash();
     void testJSPrompt();
     void showModalDialog();
     void testStopScheduledPageRefresh();
@@ -2848,17 +2849,30 @@ void tst_QWebPage::originatingObjectInNetworkRequests()
         QVERIFY(qobject_cast<QWebFrame*>(networkManager->requests.at(i).originatingObject()) == childFrames.at(i));
 }
 
-void tst_QWebPage::networkReplyParentChanged()
+void tst_QWebPage::networkReplyParentDidntChange()
 {
     TestNetworkManager* networkManager = new TestNetworkManager(m_page);
     m_page->setNetworkAccessManager(networkManager);
     networkManager->requests.clear();
 
-    // Trigger a load and check if pending QNetworkReplies have been reparented before returning to the event loop.
+    // Trigger a load and check that pending QNetworkReplies haven't been reparented before returning to the event loop.
     m_view->load(QUrl("qrc:///resources/content.html"));
 
     QVERIFY(networkManager->requests.count() > 0);
-    QVERIFY(networkManager->findChildren<QNetworkReply*>().isEmpty());
+    QVERIFY(networkManager->findChildren<QNetworkReply*>().size() > 0);
+}
+
+void tst_QWebPage::destroyQNAMBeforeAbortDoesntCrash()
+{
+    QNetworkAccessManager* networkManager = new QNetworkAccessManager;
+    m_page->setNetworkAccessManager(networkManager);
+
+    m_view->load(QUrl("qrc:///resources/content.html"));
+    delete networkManager;
+    // This simulates what PingLoader does with its QNetworkReply when it times out.
+    // PingLoader isn't attached to a QWebPage and can be kept alive
+    // for 60000 seconds (~16.7 hours) to then cancel its ResourceHandle.
+    m_view->stop();
 }
 
 /**