2008-08-12 Urs Wolfer <uwolfer@kde.org>

        Reviewed by Simon.

        https://bugs.webkit.org/show_bug.cgi?id=20357

        Fix crash in QWebPage in case contextMenuEvent has been overwritten
        because context menu has the view as parent and thus is deleted too early.

        Add testcase for this crash.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@35681 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/WebKit/qt/Api/qwebpage_p.h b/WebKit/qt/Api/qwebpage_p.h
index 1d5e1dec0180ef11d3c0a8dc77fbd0f6438af5da..0a359b76402f8c85a1574ef315a3de0deb3e4330 100644 (file)
--- a/WebKit/qt/Api/qwebpage_p.h
+++ b/WebKit/qt/Api/qwebpage_p.h
@@ -145,7 +145,7 @@ public:
     QSize viewportSize;
     QWebHistory history;
     QWebHitTestResult hitTestResult;
-    QMenu *currentContextMenu;
+    QPointer<QMenu> currentContextMenu;
     QWebSettings *settings;
     QPalette palette;
     bool editable;

diff --git a/WebKit/qt/ChangeLog b/WebKit/qt/ChangeLog
index 42ab6a29572eeafe310b52d050c4462053b03dd5..7e4405818c20e23f4582733f7c63e5dcd9f85bfe 100644 (file)
--- a/WebKit/qt/ChangeLog
+++ b/WebKit/qt/ChangeLog
@@ -1,3 +1,18 @@
+2008-08-12  Urs Wolfer  <uwolfer@kde.org>
+
+        Reviewed by Simon.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20357
+
+        Fix crash in QWebPage in case contextMenuEvent has been overwritten
+        because context menu has the view as parent and thus is deleted too early.
+
+        Add testcase for this crash.
+
+        * Api/qwebpage_p.h:
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::contextMenuCrash):
+
 2008-08-07  Simon Hausmann  <hausmann@webkit.org>
 
         Rubber-stamped by Lars.

diff --git a/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp b/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
index 622e9fbeeaaffd41afa04c9ee714cd69de02926e..7c443ca2773e44abbb44f6510ff6c0eed5b79855 100644 (file)
--- a/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
+++ b/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
@@ -27,6 +27,7 @@
 #include <qwebhistory.h>
 #include <qnetworkrequest.h>
 #include <QDebug>
+#include <QMenu>
 
 // Will try to wait for the condition while allowing event processing
 #define QTRY_COMPARE(__expr, __expected) \
@@ -87,6 +88,7 @@ private slots:
     void acceptNavigationRequestWithNewWindow();
     void userStyleSheet();
     void modified();
+    void contextMenuCrash();
 
 private:
 
@@ -301,5 +303,20 @@ void tst_QWebPage::modified()
     QVERIFY(!m_page->isModified());
 }
 
+void tst_QWebPage::contextMenuCrash()
+{
+    QWebView view;
+    view.setHtml("<p>test");
+    view.page()->updatePositionDependentActions(QPoint(0, 0));
+    QMenu* contextMenu = 0;
+    foreach (QObject* child, view.children()) {
+        contextMenu = qobject_cast<QMenu*>(child);
+        if (contextMenu)
+            break;
+    }
+    QVERIFY(contextMenu);
+    delete contextMenu;
+}
+
 QTEST_MAIN(tst_QWebPage)
 #include "tst_qwebpage.moc"