Fix for 1498134, possible crash when cancelling a url request. The...

chrome/browser/resource_dispatcher_host.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // See http://wiki.corp.google.com/twiki/bin/view/Main/ChromeMultiProcessResourceLoading
 
 #include <vector>
 
 #include "chrome/browser/resource_dispatcher_host.h"
 
@@ skipping 1711 matching lines @@
   extra_info->allow_download = false;
   extra_info->is_download = false;
   request->set_user_data(extra_info);  // Takes pointer ownership.
 
   BeginRequestInternal(request, false);
 }
 
 void ResourceDispatcherHost::CancelRequest(int render_process_host_id,
                                            int request_id,
                                            bool from_renderer) {
+  CancelRequest(render_process_host_id, request_id, from_renderer, true);
+}
+
+void ResourceDispatcherHost::CancelRequest(int render_process_host_id,
+                                           int request_id,
+                                           bool from_renderer,
+                                           bool allow_delete) {
   PendingRequestList::iterator i = pending_requests_.find(
       GlobalRequestID(render_process_host_id, request_id));
   if (i == pending_requests_.end()) {
     // We probably want to remove this warning eventually, but I wanted to be
     // able to notice when this happens during initial development since it
     // should be rare and may indicate a bug.
     DLOG(WARNING) << "Canceling a request that wasn't found";
     return;
   }
 
   // WebKit will send us a cancel for downloads since it no longer handles them.
   // In this case, ignore the cancel since we handle downloads in the browser.
   ExtraRequestInfo* info = ExtraInfoForRequest(i->second);
   if (!from_renderer || !info->is_download) {
     if (info->login_handler) {
       info->login_handler->OnRequestCancelled();
       info->login_handler = NULL;
     }
-    i->second->Cancel();
+    if (!i->second->is_pending() && allow_delete) {
+      // No io is pending, canceling the request won't notify us of anything,
+      // so we explicitly remove it.
+      // TODO: removing the request in this manner means we're not notifying
+      // anyone. We need make sure the event handlers and others are notified
+      // so that everything is cleaned up properly.
+      RemovePendingRequest(info->render_process_host_id, info->request_id);
+    } else {
+      i->second->Cancel();
+    }
   }
 
   // Do not remove from the pending requests, as the request will still
   // call AllDataReceived, and may even have more data before it does
   // that.
 }
 
 void ResourceDispatcherHost::OnDataReceivedACK(int render_process_host_id,
                                                int request_id) {
   PendingRequestList::iterator i = pending_requests_.find(
@@ skipping 466 matching lines @@
 bool ResourceDispatcherHost::CompleteRead(URLRequest* request,
                                           int* bytes_read) {
   if (!request->status().is_success()) {
     NOTREACHED();
     return false;
   }
 
   ExtraRequestInfo* info = ExtraInfoForRequest(request);
 
   if (!info->event_handler->OnReadCompleted(info->request_id, bytes_read)) {
-    CancelRequest(info->render_process_host_id, info->request_id, false);
+    // Pass in false as the last arg to indicate we don't want |request|
+    // deleted. We do this as callers of us assume |request| is valid after we
+    // return.
+    CancelRequest(info->render_process_host_id, info->request_id, false, false);
     return false;
   }
 
   return *bytes_read != 0;
 }
 
 void ResourceDispatcherHost::OnResponseCompleted(URLRequest* request) {
   RESOURCE_LOG("OnResponseCompleted: " << request->url().spec());
   ExtraRequestInfo* info = ExtraInfoForRequest(request);
 
@@ skipping 243 matching lines @@
   bool enough_new_progress = (amt_since_last > (size / kHalfPercentIncrements));
   bool too_much_time_passed = time_since_last > kOneSecond;
 
   if (is_finished || enough_new_progress || too_much_time_passed) {
     info->event_handler->OnUploadProgress(info->request_id, position, size);
     info->waiting_for_upload_progress_ack = true;
     info->last_upload_ticks = TimeTicks::Now();
     info->last_upload_position = position;
   }
 }