Fix a crash when the content type of a multipart request

Fix a crash when the content type of a multipart request
changes to a content type that we ignore the load of.

For example, if the content type of a multipart request changes
from text/html to foo/bar, we would crash because we would
delete the multipart delegate while it was still on the stack.

BUG=47105
Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=50676

[tony, 2010-06-23 07:26:04]

Below is an example stack.  What happens is in frame 18, the multipart delegate
parses the chunk header and tells webkit about it.  WebKit checks the content
policy of the mime type.  If we reject the mime type in
FrameLoaderClientImpl::dispatchDecidePolicyForMIMEType, we cancel the request. 
When we cancel the request, we delete the multipart delegate (frame 0 below),
which is still on the stack, causing us to crash when we unwind the stack.

The fix is to not delete the multipart delegate, just clear out the invalid
client_ and loader_ pointers and ignore any data we might get in the future.

I have a test for this, but it's a layout test, so I'll cc you on that upstream.


#0  webkit_glue::WebURLLoaderImpl::Context::Cancel (this=0x7fffeac95960)
    at webkit/glue/weburlloader_impl.cc:273
#1  0x00000000013b75eb in webkit_glue::WebURLLoaderImpl::cancel (this=
    0x7ffff7f4b0b0) at webkit/glue/weburlloader_impl.cc:652
#2  0x00000000017a94f5 in WebCore::ResourceHandleInternal::cancel (this=
    0x7fffed62dd80)
    at third_party/WebKit/WebKit/chromium/src/ResourceHandle.cpp:117
#3  0x00000000017a9527 in WebCore::ResourceHandle::cancel (this=0x7fffed5511a0)
    at third_party/WebKit/WebKit/chromium/src/ResourceHandle.cpp:261
#4  0x0000000000b84f96 in WebCore::ResourceLoader::didCancel (this=
    0x7fffead6d000, error=...)
    at third_party/WebKit/WebCore/loader/ResourceLoader.cpp:341
#5  0x0000000000b7b12f in WebCore::MainResourceLoader::didCancel (this=
    0x7fffead6d000, error=...)
    at third_party/WebKit/WebCore/loader/MainResourceLoader.cpp:105
#6  0x0000000000b84e36 in WebCore::ResourceLoader::cancel (this=
    0x7fffead6d000, error=...)
    at third_party/WebKit/WebCore/loader/ResourceLoader.cpp:360
#7  0x0000000000b7afee in
WebCore::MainResourceLoader::stopLoadingForPolicyChange (this=0x7fffead6d000)
    at third_party/WebKit/WebCore/loader/MainResourceLoader.cpp:115
#8  0x0000000000b7b574 in
WebCore::MainResourceLoader::continueAfterContentPolicy (this=0x7fffead6d000,
contentPolicy=WebCore::PolicyIgnore, r=...)
    at third_party/WebKit/WebCore/loader/MainResourceLoader.cpp:233
#9  0x0000000000b7b934 in
WebCore::MainResourceLoader::continueAfterContentPolicy (this=0x7fffead6d000,
policy=WebCore::PolicyIgnore)
    at third_party/WebKit/WebCore/loader/MainResourceLoader.cpp:281
#10 0x0000000000b7b95f in
WebCore::MainResourceLoader::callContinueAfterContentPolicy
(argument=0x7fffead6d000, policy=WebCore::PolicyIgnore)
    at third_party/WebKit/WebCore/loader/MainResourceLoader.cpp:273
#11 0x0000000000b7e7e7 in WebCore::PolicyCallback::call (this=0x7fffffffbde0, 
    action=WebCore::PolicyIgnore)
    at third_party/WebKit/WebCore/loader/PolicyCallback.cpp:112
#12 0x0000000000b7f0aa in WebCore::PolicyChecker::continueAfterContentPolicy (
    this=0x7fffead72460, policy=WebCore::PolicyIgnore)
    at third_party/WebKit/WebCore/loader/PolicyChecker.cpp:187
#13 0x00000000008fb610 in
WebKit::FrameLoaderClientImpl::dispatchDecidePolicyForMIMEType
(this=0x7fffee2dd410, 
    function=0xb7f04a
<WebCore::PolicyChecker::continueAfterContentPolicy(WebCore::PolicyAction)>,
mimeType=...)
    at third_party/WebKit/WebKit/chromium/src/FrameLoaderClientImpl.cpp:857
#14 0x0000000000b7f518 in WebCore::PolicyChecker::checkContentPolicy (this=
    0x7fffead72460, MIMEType=..., 
    function=0xb7b944
<WebCore::MainResourceLoader::callContinueAfterContentPolicy(void*,
WebCore::PolicyAction)>, argument=0x7fffead6d000)
    at third_party/WebKit/WebCore/loader/PolicyChecker.cpp:104
#15 0x0000000000b7bd8e in WebCore::MainResourceLoader::didReceiveResponse (
    this=0x7fffead6d000, r=...)
    at third_party/WebKit/WebCore/loader/MainResourceLoader.cpp:372
#16 0x0000000000b84bb4 in WebCore::ResourceLoader::didReceiveResponse (this=
    0x7fffead6d000, response=...)
    at third_party/WebKit/WebCore/loader/ResourceLoader.cpp:412
#17 0x00000000017aa100 in WebCore::ResourceHandleInternal::didReceiveResponse (
    this=0x7fffed62dd80, response=...)
    at third_party/WebKit/WebKit/chromium/src/ResourceHandle.cpp:159
#18 0x00000000013a4750 in webkit_glue::MultipartResponseDelegate::ParseHeaders
    (this=0x7fffed61b090) at webkit/glue/multipart_response_delegate.cc:250
#19 0x00000000013a4c26 in webkit_glue::MultipartResponseDelegate::OnReceivedData
(this=0x7fffed61b090, data=
    0x7fffead6f900 "--asdf\nContent-type:
text/html\nhello\n\n--asdf\n\nworld!\n\n--asdf\n\177", data_len=61) at
webkit/glue/multipart_response_delegate.cc:147
#20 0x00000000013b7996 in webkit_glue::WebURLLoaderImpl::Context::OnReceivedData
(this=0x7fffeac95960, data=
    0x7fffead6f900 "--asdf\nContent-type:
text/html\nhello\n\n--asdf\n\nworld!\n\n--asdf\n\177", len=61) at
webkit/glue/weburlloader_impl.cc:533
#21 0x00000000013e0ec2 in NotifyReceivedData (this=0x7fffeac96280, 
    bytes_read=61)
    at webkit/tools/test_shell/simple_resource_loader_bridge.cc:244
#22 0x00000000013dcca7 in DispatchToMethod<<unnamed>::RequestProxy, void (<unnam
ed>::RequestProxy::*)(int), int> (obj=0x7fffeac96280, 
    method=0x13e0dce <NotifyReceivedData>, arg=...) at ./base/tuple.h:422
#23 0x00000000013dcce4 in Run (this=0x7fffed622b80) at ./base/task.h:323
#24 0x0000000000508d49 in MessageLoop::RunTask (this=0x7fffffffdf60, task=
    0x7fffed622b80) at base/message_loop.cc:340

[tony, 2010-06-23 08:20:43]

The layout test is https://bugs.webkit.org/show_bug.cgi?id=41050

[darin (slow to review), 2010-06-23 15:16:52]

LGTM

http://codereview.chromium.org/2850023/diff/1/3
File webkit/glue/multipart_response_delegate.h (right):

http://codereview.chromium.org/2850023/diff/1/3#newcode79
webkit/glue/multipart_response_delegate.h:79: void cancel() {
nit: cancel -> Cancel