Details
Description
A crash occurs with QWebView in the following case:
1. QWebSettings::globalSettings()->setIconDatabasePath is called to enable fetching of favicons
2. A website is loaded with a favicon and contains http-equiv refresh with 0 delay to another site. This results in the page load being canceled.
3. The slot on_webView_loadFinished which handles the QWebView::loadFinished signal shows a message box which re-enters the event loop and delays returning control to the sender of the loadFinished signal for some time. During this time, other signals may fire and run in a different order than normally expected because control has not yet returned to the sender of the loadFinished signal.
4. As a result of the previous step, ResourceLoader::didFinishLoading is executed first and calls releaseResources() which nulls m_documentLoader + sets m_reachedTerminalState to true. ResourceLoader::didCancel is executed afterwards, the asserts fail and a null pointer is dereferenced: m_documentLoader->cancelPendingSubstituteLoad(this).