From b070ad6a9804b6a7387f848c2e1721c16b8ccc62 Mon Sep 17 00:00:00 2001 From: Sami Rosendahl Date: Wed, 7 Dec 2011 13:57:18 +0100 Subject: Fix NB#290352 Qtwebprocess crashes @ QHttpNetworkReply::readAny Several crash backtraces point to crash in QHttpNetworkReply::readAny, where d->connection==0. This patch adds a check for d->connection to QNetworkAccessHttpBackend. If the connection is found to be destroyed, the request is finished. Does not need to be merged to 4.8 because the internals have changed (Peter Hartmann) PMO 290352 Merge-request: 1491 Reviewed-by: Peter Hartmann --- src/network/access/qnetworkaccesshttpbackend.cpp | 6 ++++ tests/auto/qnetworkreply/tst_qnetworkreply.cpp | 44 ++++++++++++++++++++++++ 2 files changed, 50 insertions(+) diff --git a/src/network/access/qnetworkaccesshttpbackend.cpp b/src/network/access/qnetworkaccesshttpbackend.cpp index aa477fb..42dc33d 100644 --- a/src/network/access/qnetworkaccesshttpbackend.cpp +++ b/src/network/access/qnetworkaccesshttpbackend.cpp @@ -721,6 +721,12 @@ void QNetworkAccessHttpBackend::readFromHttp() if (!httpReply) return; + if (!http) { + // Connection has been destroyed + finished(); + return; + } + // We read possibly more than nextDownstreamBlockSize(), but // this is not a critical thing since it is already in the // memory anyway diff --git a/tests/auto/qnetworkreply/tst_qnetworkreply.cpp b/tests/auto/qnetworkreply/tst_qnetworkreply.cpp index 28832b2..d4e388d 100644 --- a/tests/auto/qnetworkreply/tst_qnetworkreply.cpp +++ b/tests/auto/qnetworkreply/tst_qnetworkreply.cpp @@ -317,6 +317,8 @@ private Q_SLOTS: void getAndThenDeleteObject_data(); void getAndThenDeleteObject(); + void deleteManagerWhileGetIsInProgress(); + void symbianOpenCDataUrlCrash(); void qtbug12908compressedHttpReply(); @@ -5109,6 +5111,48 @@ void tst_QNetworkReply::getAndThenDeleteObject() } } +void tst_QNetworkReply::deleteManagerWhileGetIsInProgress() +{ + // yes, this will leak if the testcase fails. I don't care. It must not fail then :P + QNetworkAccessManager *manager = new QNetworkAccessManager(); + QNetworkRequest request("http://" + QtNetworkSettings::serverName() + "/qtest/bigfile"); + QNetworkReply *reply = manager->get(request); + reply->setReadBufferSize(1024); + + // Reset reply's parent to allow it to outlive the manager + reply->setParent(0); + + // Wait until a buffer is received + int totalWait = 0; + while (!reply->bytesAvailable()) { + QTest::qWait(20); + totalWait += 20; + QVERIFY( totalWait <= 5*1000); + } + + QVERIFY(reply->bytesAvailable()); + QCOMPARE(reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt(), 200); + QVERIFY(!reply->isFinished()); // must not be finished + + // Read the data to request next buffer's worth from the server + (void)reply->readAll(); + + QSignalSpy replyFinishedSpy(reply, SIGNAL(finished())); + + // Delete the manager + delete manager; + manager = 0; + + // Wait to allow reply to process any pending events + QTest::qWait(100); + + // The reply should be finished + QVERIFY(reply->isFinished()); + QCOMPARE(replyFinishedSpy.count(), 1); + + delete reply; +} + // see https://bugs.webkit.org/show_bug.cgi?id=38935 void tst_QNetworkReply::symbianOpenCDataUrlCrash() { -- cgit v0.12 From 870c4e7b9ce6143ae48f717265094d4f7e0d2434 Mon Sep 17 00:00:00 2001 From: Jiang Jiang Date: Fri, 16 Dec 2011 14:21:49 +0100 Subject: Fix crash in positionInLigature Check boundary of pos before accessing attributes. Task-number: QTBUG-23104 Reviewed-by: Eskil --- src/gui/text/qtextengine.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/gui/text/qtextengine.cpp b/src/gui/text/qtextengine.cpp index ee2eef6..66773c6 100644 --- a/src/gui/text/qtextengine.cpp +++ b/src/gui/text/qtextengine.cpp @@ -2805,7 +2805,7 @@ int QTextEngine::positionInLigature(const QScriptItem *si, int end, closestItem--; int pos = si->position + clusterStart + closestItem; // Jump to the next charStop - while (!attrs[pos].charStop && pos < end) + while (pos < end && !attrs[pos].charStop) pos++; return pos; } -- cgit v0.12 From 1e4c00f4a1844c040f24162844ed35d624ef59d2 Mon Sep 17 00:00:00 2001 From: Sergio Ahumada Date: Thu, 29 Dec 2011 22:41:09 +0100 Subject: Doc: Add `-xunitxml' option to qtestlib documentation Task-number: QTBUG-14305 Reviewed-by: Casper van Donderen --- doc/src/development/qtestlib.qdoc | 2 ++ 1 file changed, 2 insertions(+) diff --git a/doc/src/development/qtestlib.qdoc b/doc/src/development/qtestlib.qdoc index 80bf838..d0264f8 100644 --- a/doc/src/development/qtestlib.qdoc +++ b/doc/src/development/qtestlib.qdoc @@ -195,6 +195,8 @@ outputs XML formatted results instead of plain text \o \c -lightxml \BR outputs results as a stream of XML tags + \o \c -xunitxml \BR + outputs results as an Xunit XML document \o \c -eventdelay \e ms \BR if no delay is specified for keyboard or mouse simulation (\l QTest::keyClick(), -- cgit v0.12 From 4ddc7c52d6c00239f97e85c7fc5c20a0f87d3539 Mon Sep 17 00:00:00 2001 From: Sergio Ahumada Date: Sat, 31 Dec 2011 13:40:49 +0100 Subject: Revert "Fix NB#290352 Qtwebprocess crashes @ QHttpNetworkReply::readAny" This reverts commit b070ad6a9804b6a7387f848c2e1721c16b8ccc62. Regarding the comments on b070ad6a9804b6a7387f848c2e1721c16b8ccc62 in 4.7, this should not be merged into 4.8 since the internals have changed. Conflicts: src/network/access/qnetworkaccesshttpbackend.cpp --- tests/auto/qnetworkreply/tst_qnetworkreply.cpp | 44 -------------------------- 1 file changed, 44 deletions(-) diff --git a/tests/auto/qnetworkreply/tst_qnetworkreply.cpp b/tests/auto/qnetworkreply/tst_qnetworkreply.cpp index ebf667f..371ac57 100644 --- a/tests/auto/qnetworkreply/tst_qnetworkreply.cpp +++ b/tests/auto/qnetworkreply/tst_qnetworkreply.cpp @@ -345,8 +345,6 @@ private Q_SLOTS: void getAndThenDeleteObject_data(); void getAndThenDeleteObject(); - void deleteManagerWhileGetIsInProgress(); - void symbianOpenCDataUrlCrash(); void getFromHttpIntoBuffer_data(); @@ -5661,48 +5659,6 @@ void tst_QNetworkReply::getAndThenDeleteObject() } } -void tst_QNetworkReply::deleteManagerWhileGetIsInProgress() -{ - // yes, this will leak if the testcase fails. I don't care. It must not fail then :P - QNetworkAccessManager *manager = new QNetworkAccessManager(); - QNetworkRequest request("http://" + QtNetworkSettings::serverName() + "/qtest/bigfile"); - QNetworkReply *reply = manager->get(request); - reply->setReadBufferSize(1024); - - // Reset reply's parent to allow it to outlive the manager - reply->setParent(0); - - // Wait until a buffer is received - int totalWait = 0; - while (!reply->bytesAvailable()) { - QTest::qWait(20); - totalWait += 20; - QVERIFY( totalWait <= 5*1000); - } - - QVERIFY(reply->bytesAvailable()); - QCOMPARE(reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt(), 200); - QVERIFY(!reply->isFinished()); // must not be finished - - // Read the data to request next buffer's worth from the server - (void)reply->readAll(); - - QSignalSpy replyFinishedSpy(reply, SIGNAL(finished())); - - // Delete the manager - delete manager; - manager = 0; - - // Wait to allow reply to process any pending events - QTest::qWait(100); - - // The reply should be finished - QVERIFY(reply->isFinished()); - QCOMPARE(replyFinishedSpy.count(), 1); - - delete reply; -} - // see https://bugs.webkit.org/show_bug.cgi?id=38935 void tst_QNetworkReply::symbianOpenCDataUrlCrash() { -- cgit v0.12