We found that QNetworkReplyHandler::m_reply has never been freed in some cases because QNetworkReplyHandler::release sets it to zero. Through that the call of deleteLater on it in QNetworkRepyHandler is useless. We did not see any problem when we had removed the problematic line.
Created attachment 29223 [details] proposed patch
Comment on attachment 29223 [details] proposed patch I agree that there's probably a leak, but the purpose of release() is to transfer the ownership to the caller. If we don't reset m_reply to 0 a subsequent call to release() will return a pointer to the object whos ownership we transferred to the previous caller. In other words: I think the caller in abort() for example should call deleteLater on the reply(). Does that work for you?
Ops, sorry for the late response, this bug had got out of my mind. You are absolute right, the solution is to simply call deleteLater on reply in abort.
Created attachment 29330 [details] proposed patch
Landed in r42747. Thanks! http://trac.webkit.org/changeset/42747
*** Bug 26922 has been marked as a duplicate of this bug. ***