Http cache: Make sure that the memory used to receive the...

net/http/http_cache.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_cache.h"
 
 #include <algorithm>
 
 #include "base/compiler_specific.h"
 
@@ skipping 45 matching lines @@
     disk_entry->Close();
     disk_entry = NULL;
   }
 }
 
 //-----------------------------------------------------------------------------
 
 // This structure keeps track of work items that are attempting to create or
 // open cache entries or the backend itself.
 struct HttpCache::PendingOp {
-  PendingOp() : disk_entry(NULL), writer(NULL), callback(NULL) {}
+  PendingOp() : disk_entry(NULL), backend(NULL), writer(NULL), callback(NULL) {}
   ~PendingOp() {}
 
   disk_cache::Entry* disk_entry;
+  disk_cache::Backend* backend;
   WorkItem* writer;
   CompletionCallback* callback;  // BackendCallback.
   WorkItemList pending_queue;
 };
 
 //-----------------------------------------------------------------------------
 
 // The type of operation represented by a work item.
 enum WorkItemOperation {
   WI_CREATE_BACKEND,
@@ skipping 56 matching lines @@
 
 // This class is a specialized type of CompletionCallback that allows us to
 // pass multiple arguments to the completion routine.
 class HttpCache::BackendCallback : public CallbackRunner<Tuple1<int> > {
  public:
   BackendCallback(HttpCache* cache, PendingOp* pending_op)
       : cache_(cache), pending_op_(pending_op) {}
   ~BackendCallback() {}
 
   virtual void RunWithParams(const Tuple1<int>& params) {
-    if (cache_)
+    if (cache_) {
       cache_->OnIOComplete(params.a, pending_op_);
+    } else {
+      // The callback was cancelled so we should delete the pending_op that
+      // was used with this callback.
+      delete pending_op_;
+    }
     delete this;
   }
 
   void Cancel() {
     cache_ = NULL;
   }
 
  private:
   HttpCache* cache_;
   PendingOp* pending_op_;
@@ skipping 78 matching lines @@
 
 //-----------------------------------------------------------------------------
 
 HttpCache::HttpCache(HostResolver* host_resolver, ProxyService* proxy_service,
                      SSLConfigService* ssl_config_service,
                      HttpAuthHandlerFactory* http_auth_handler_factory,
                      HttpNetworkDelegate* network_delegate,
                      NetLog* net_log,
                      BackendFactory* backend_factory)
     : backend_factory_(backend_factory),
-      temp_backend_(NULL),
       building_backend_(false),
       mode_(NORMAL),
       network_layer_(HttpNetworkLayer::CreateFactory(host_resolver,
           proxy_service, ssl_config_service, http_auth_handler_factory,
           network_delegate, net_log)),
       ALLOW_THIS_IN_INITIALIZER_LIST(task_factory_(this)),
       enable_range_support_(true) {
 }
 
 HttpCache::HttpCache(HttpNetworkSession* session,
                      BackendFactory* backend_factory)
     : backend_factory_(backend_factory),
-      temp_backend_(NULL),
       building_backend_(false),
       mode_(NORMAL),
       network_layer_(HttpNetworkLayer::CreateFactory(session)),
       ALLOW_THIS_IN_INITIALIZER_LIST(task_factory_(this)),
       enable_range_support_(true) {
 }
 
 HttpCache::HttpCache(HttpTransactionFactory* network_layer,
                      BackendFactory* backend_factory)
     : backend_factory_(backend_factory),
-      temp_backend_(NULL),
       building_backend_(false),
       mode_(NORMAL),
       network_layer_(network_layer),
       ALLOW_THIS_IN_INITIALIZER_LIST(task_factory_(this)),
       enable_range_support_(true) {
 }
 
 HttpCache::~HttpCache() {
   // If we have any active entries remaining, then we need to deactivate them.
   // We may have some pending calls to OnProcessPendingQueue, but since those
   // won't run (due to our destruction), we can simply ignore the corresponding
   // will_process_pending_queue flag.
   while (!active_entries_.empty()) {
     ActiveEntry* entry = active_entries_.begin()->second;
     entry->will_process_pending_queue = false;
     entry->pending_queue.clear();
     entry->readers.clear();
     entry->writer = NULL;
     DeactivateEntry(entry);
   }
 
   STLDeleteElements(&doomed_entries_);
 
   PendingOpsMap::iterator pending_it = pending_ops_.begin();
   for (; pending_it != pending_ops_.end(); ++pending_it) {
     // We are not notifying the transactions about the cache going away, even
     // though they are waiting for a callback that will never fire.
     PendingOp* pending_op = pending_it->second;
     delete pending_op->writer;
+    bool delete_pending_op = true;
     if (building_backend_) {
       // If we don't have a backend, when its construction finishes it will
       // deliver the callbacks.
       BackendCallback* callback =
           static_cast<BackendCallback*>(pending_op->callback);
-      if (callback)
+      if (callback) {
+        // The callback will delete the pending operation.
         callback->Cancel();
+        delete_pending_op = false;
+      }
     } else {
       delete pending_op->callback;
     }
 
     STLDeleteElements(&pending_op->pending_queue);
-    delete pending_op;
+    if (delete_pending_op)
+      delete pending_op;
   }
 }
 
 int HttpCache::GetBackend(disk_cache::Backend** backend,
                           CompletionCallback* callback) {
   DCHECK(callback != NULL);
 
   if (disk_cache_.get()) {
     *backend = disk_cache_.get();
     return OK;
@@ skipping 87 matching lines @@
       pending_op->pending_queue.push_back(item.release());
     return ERR_IO_PENDING;
   }
 
   DCHECK(pending_op->pending_queue.empty());
 
   pending_op->writer = item.release();
   BackendCallback* my_callback = new BackendCallback(this, pending_op);
   pending_op->callback = my_callback;
 
-  int rv = backend_factory_->CreateBackend(&temp_backend_, my_callback);
+  int rv = backend_factory_->CreateBackend(&pending_op->backend, my_callback);
   if (rv != ERR_IO_PENDING) {
     pending_op->writer->ClearCallback();
     my_callback->Run(rv);
   }
 
   return rv;
 }
 
 int HttpCache::GetBackendForTransaction(Transaction* trans) {
   if (disk_cache_.get())
@@ skipping 578 matching lines @@
   }
 }
 
 void HttpCache::OnBackendCreated(int result, PendingOp* pending_op) {
   scoped_ptr<WorkItem> item(pending_op->writer);
   WorkItemOperation op = item->operation();
   DCHECK_EQ(WI_CREATE_BACKEND, op);
 
   // We don't need the callback anymore.
   pending_op->callback = NULL;
+  disk_cache::Backend* backend = pending_op->backend;
 
   if (backend_factory_.get()) {
     // We may end up calling OnBackendCreated multiple times if we have pending
     // work items. The first call saves the backend and releases the factory,
     // and the last call clears building_backend_.
     backend_factory_.reset();  // Reclaim memory.
     if (result == OK)
-      disk_cache_.reset(temp_backend_);
+      disk_cache_.reset(backend);
   }
 
   if (!pending_op->pending_queue.empty()) {
     WorkItem* pending_item = pending_op->pending_queue.front();
     pending_op->pending_queue.pop_front();
     DCHECK_EQ(WI_CREATE_BACKEND, pending_item->operation());
 
     // We want to process a single callback at a time, because the cache may
     // go away from the callback.
     pending_op->writer = pending_item;
 
     MessageLoop::current()->PostTask(
         FROM_HERE,
         task_factory_.NewRunnableMethod(&HttpCache::OnBackendCreated,
                                         result, pending_op));
   } else {
     building_backend_ = false;
     DeletePendingOp(pending_op);
   }
 
   // The cache may be gone when we return from the callback.
-  if (!item->DoCallback(result, temp_backend_))
+  if (!item->DoCallback(result, backend))
     item->NotifyTransaction(result, NULL);
 }
 
 }  // namespace net