Fix NB#290352 Qtwebprocess crashes @ QHttpNetworkReply::readAny

Several crash backtraces point to crash in QHttpNetworkReply::readAny,
where d->connection==0. This patch adds a check for d->connection to
QNetworkAccessHttpBackend. If the connection is found to be destroyed,
the request is finished.

Does not need to be merged to 4.8 because the internals have changed
(Peter Hartmann)

PMO 290352

Merge-request: 1491
Reviewed-by: Peter Hartmann <peter.hartmann@nokia.com>

2 files changed, 50 insertions, 0 deletions

diff --git a/src/network/access/qnetworkaccesshttpbackend.cpp b/src/network/access/qnetworkaccesshttpbackend.cpp
index aa477fbd4d..42dc33dd76 100644
--- a/src/network/access/qnetworkaccesshttpbackend.cpp
+++ b/src/network/access/qnetworkaccesshttpbackend.cpp
@@ -721,6 +721,12 @@ void QNetworkAccessHttpBackend::readFromHttp()
     if (!httpReply)
         return;
 
+    if (!http) {
+        // Connection has been destroyed
+        finished();
+        return;
+    }
+
     // We read possibly more than nextDownstreamBlockSize(), but
     // this is not a critical thing since it is already in the
     // memory anyway
diff --git a/tests/auto/qnetworkreply/tst_qnetworkreply.cpp b/tests/auto/qnetworkreply/tst_qnetworkreply.cpp
index 28832b2089..d4e388d643 100644
--- a/tests/auto/qnetworkreply/tst_qnetworkreply.cpp
+++ b/tests/auto/qnetworkreply/tst_qnetworkreply.cpp
@@ -317,6 +317,8 @@ private Q_SLOTS:
     void getAndThenDeleteObject_data();
     void getAndThenDeleteObject();
 
+    void deleteManagerWhileGetIsInProgress();
+
     void symbianOpenCDataUrlCrash();
 
     void qtbug12908compressedHttpReply();
@@ -5109,6 +5111,48 @@ void tst_QNetworkReply::getAndThenDeleteObject()
     }
 }
 
+void tst_QNetworkReply::deleteManagerWhileGetIsInProgress()
+{
+    // yes, this will leak if the testcase fails. I don't care. It must not fail then :P
+    QNetworkAccessManager *manager = new QNetworkAccessManager();
+    QNetworkRequest request("http://" + QtNetworkSettings::serverName() + "/qtest/bigfile");
+    QNetworkReply *reply = manager->get(request);
+    reply->setReadBufferSize(1024);
+
+    // Reset reply's parent to allow it to outlive the manager
+    reply->setParent(0);
+
+    // Wait until a buffer is received
+    int totalWait = 0;
+    while (!reply->bytesAvailable()) {
+        QTest::qWait(20);
+        totalWait += 20;
+        QVERIFY( totalWait <= 5*1000);
+    }
+
+    QVERIFY(reply->bytesAvailable());
+    QCOMPARE(reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt(), 200);
+    QVERIFY(!reply->isFinished()); // must not be finished
+
+    // Read the data to request next buffer's worth from the server
+    (void)reply->readAll();
+
+    QSignalSpy replyFinishedSpy(reply, SIGNAL(finished()));
+
+    // Delete the manager
+    delete manager;
+    manager = 0;
+
+    // Wait to allow reply to process any pending events
+    QTest::qWait(100);
+
+    // The reply should be finished
+    QVERIFY(reply->isFinished());
+    QCOMPARE(replyFinishedSpy.count(), 1);
+
+    delete reply;
+}
+
 // see https://bugs.webkit.org/show_bug.cgi?id=38935
 void tst_QNetworkReply::symbianOpenCDataUrlCrash()
 {