Make sure that the LoadLog does not get freed on the worker thread during req...

net/base/host_resolver_impl.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/host_resolver_impl.h"
 
 #if defined(OS_WIN)
 #include <ws2tcpip.h>
 #include <wspiapi.h>  // Needed for Win2k compat.
 #elif defined(OS_POSIX)
@@ skipping 55 matching lines @@
         job_(NULL),
         callback_(callback),
         addresses_(addresses) {
   }
 
   // Mark the request as cancelled.
   void MarkAsCancelled() {
     job_ = NULL;
     callback_ = NULL;
     addresses_ = NULL;
+    // Clear the LoadLog to make sure it won't be released later on the

[wtc, 2009/09/21 18:14:12]

Do you mean clearing the load log (i.e., emptying the load
log), or releasing our reference to the load log?

+    // worker thread. See http://crbug.com/22272
+    load_log_ = NULL;
   }
 
   bool was_cancelled() const {
     return callback_ == NULL;
   }
 
   void set_job(Job* job) {
     DCHECK(job != NULL);
     // Identify which job the request is waiting on.
     job_ = job;
@@ skipping 94 matching lines @@
     HostResolver* resolver = resolver_;
     resolver_ = NULL;
 
     // Mark the job as cancelled, so when worker thread completes it will
     // not try to post completion to origin loop.
     {
       AutoLock locked(origin_loop_lock_);
       origin_loop_ = NULL;
     }
 
-    // We don't have to do anything further to actually cancel the requests
-    // that were attached to this job (since they are unreachable now).
-    // But we will call HostResolverImpl::CancelRequest(Request*) on each one
-    // in order to notify any observers.
+    // We will call HostResolverImpl::CancelRequest(Request*) on each one
+    // in order to notify any observers, and also clear the LoadLog.
     for (RequestsList::const_iterator it = requests_.begin();
          it != requests_.end(); ++it) {
       HostResolverImpl::Request* req = *it;
       if (!req->was_cancelled())
         resolver->CancelRequest(req);
     }
   }
 
   // Called from origin thread.
   bool was_cancelled() const {
@@ skipping 184 matching lines @@
     // TODO(eroman): temp hack for: http://crbug.com/18373
     // Because we destroy outstanding requests during Shutdown(),
     // |req_handle| is already cancelled.
     LOG(ERROR) << "Called HostResolverImpl::CancelRequest() after Shutdown().";
     StackTrace().PrintBacktrace();
     return;
   }
   Request* req = reinterpret_cast<Request*>(req_handle);
   DCHECK(req);
   DCHECK(req->job());
+  // Hold a reference to the request's load log as we are about to clear it.

[wtc, 2009/09/21 18:14:12]

Nit: it's not clear what "it" refers to here.  Do you mean
clearing the request's reference to the load log, or clearing
the load log itself?  I think you mean the former (clearing
the req->load_log_ field).

+  scoped_refptr<LoadLog> load_log(req->load_log());
   // NULL out the fields of req, to mark it as cancelled.
   req->MarkAsCancelled();
-  OnCancelRequest(req->load_log(), req->id(), req->info());
+  OnCancelRequest(load_log, req->id(), req->info());
 }
 
 void HostResolverImpl::AddObserver(Observer* observer) {
   observers_.push_back(observer);
 }
 
 void HostResolverImpl::RemoveObserver(Observer* observer) {
   ObserversList::iterator it =
       std::find(observers_.begin(), observers_.end(), observer);
 
@@ skipping 130 matching lines @@
     }
 
     LoadLog::EndEvent(
         load_log, LoadLog::TYPE_HOST_RESOLVER_IMPL_OBSERVER_ONCANCEL);
   }
 
   LoadLog::EndEvent(load_log, LoadLog::TYPE_HOST_RESOLVER_IMPL);
 }
 
 }  // namespace net