ChromeFrame HTTP requests would randomly fail if we navigated to multiple HTT...

chrome_frame/urlmon_url_request.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome_frame/urlmon_url_request.h"
 
 #include <wininet.h>
 
 #include "base/scoped_ptr.h"
 #include "base/string_util.h"
 #include "base/logging.h"
 #include "base/message_loop.h"
 #include "chrome_frame/chrome_frame_activex_base.h"
 #include "chrome_frame/urlmon_upload_data_stream.h"
 #include "chrome_frame/utils.h"
 #include "net/http/http_util.h"
 #include "net/http/http_response_headers.h"
 
 static const LARGE_INTEGER kZero = {0};
 static const ULARGE_INTEGER kUnsignedZero = {0};
 int UrlmonUrlRequest::instance_count_ = 0;
 const char kXFrameOptionsHeader[] = "X-Frame-Options";
 
 UrlmonUrlRequest::UrlmonUrlRequest()
     : pending_read_size_(0),
       status_(URLRequestStatus::FAILED, net::ERR_FAILED),
       thread_(PlatformThread::CurrentId()),
       redirect_status_(0),
       parent_window_(NULL),
-      worker_thread_(NULL),
-      task_marshaller_(NULL) {
+      worker_thread_(NULL) {
   DLOG(INFO) << StringPrintf("Created request. Obj: %X", this)
       << " Count: " << ++instance_count_;
 }
 
 UrlmonUrlRequest::~UrlmonUrlRequest() {
   DLOG(INFO) << StringPrintf("Deleted request. Obj: %X", this)
       << " Count: " << --instance_count_;
 }
 
 bool UrlmonUrlRequest::Start() {
   DCHECK_EQ(PlatformThread::CurrentId(), thread_);
 
   if (!worker_thread_) {
     NOTREACHED() << __FUNCTION__ << " Urlmon request thread not initialized";
     return false;
   }
 
+  Create(HWND_MESSAGE);
+  if (!IsWindow()) {
+    NOTREACHED() << "Failed to create urlmon message window: "
+                 << GetLastError();
+    return false;
+  }
+
   // Take a self reference to maintain COM lifetime. This will be released
-  // in EndRequest
+  // in OnFinalMessage
   AddRef();
   request_handler()->AddRequest(this);
 
   worker_thread_->message_loop()->PostTask(
       FROM_HERE, NewRunnableMethod(this, &UrlmonUrlRequest::StartAsync));
 
   return true;
 }
 
 void UrlmonUrlRequest::Stop() {
@@ skipping 34 matching lines @@
 
   if (binding_) {
     binding_->Abort();
   } else {
     status_.set_status(URLRequestStatus::CANCELED);
     status_.set_os_error(net::ERR_FAILED);
     EndRequest();
   }
 }
 
+void UrlmonUrlRequest::OnFinalMessage(HWND window) {
+  m_hWnd = NULL;
+  // Release the outstanding reference in the context of the UI thread to
+  // ensure that our instance gets deleted in the same thread which created it.
+  Release();
+}
+
 bool UrlmonUrlRequest::Read(int bytes_to_read) {
   DCHECK_EQ(PlatformThread::CurrentId(), thread_);
 
   DLOG(INFO) << StringPrintf("URL: %s Obj: %X", url().c_str(), this);
 
   if (!worker_thread_) {
     NOTREACHED() << __FUNCTION__ << " Urlmon request thread not initialized";
     return false;
   }
 
@@ skipping 481 matching lines @@
   if (!status_.is_success() && status_.os_error() == net::ERR_ACCESS_DENIED) {
     int status = GetHttpResponseStatus();
     if (status >= 300 && status < 400) {
       redirect_status_ = status;  // store the latest redirect status value.
       status_.set_os_error(net::ERR_UNSAFE_REDIRECT);
     }
   }
 
   OnResponseEnd(status_);
 
-  DCHECK(task_marshaller_ != NULL);
-
   // Remove the request mapping and release the outstanding reference to us in
   // the context of the UI thread.
-  task_marshaller_->PostTask(
-      FROM_HERE, NewRunnableMethod(this,
-                                   &UrlmonUrlRequest::EndRequestInternal));
+  PostTask(FROM_HERE,
+           NewRunnableMethod(this, &UrlmonUrlRequest::EndRequestInternal));
 }
 
 void UrlmonUrlRequest::EndRequestInternal() {
   // The request object could have been removed from the map in the
   // OnRequestEnd callback which executes on receiving the
   // AutomationMsg_RequestEnd IPC from Chrome.
   request_handler()->RemoveRequest(this);
-  // Release the outstanding reference in the context of the UI thread to
-  // ensure that our instance gets deleted in the same thread which created it.
-  Release();
+  // The current instance could get destroyed in the context of DestroyWindow.
+  // We should not access the object after this.
+  DestroyWindow();
 }
 
 int UrlmonUrlRequest::GetHttpResponseStatus() const {
   if (binding_ == NULL) {
     DLOG(WARNING) << "GetHttpResponseStatus - no binding_";
     return 0;
   }
 
   int http_status = 0;
 
@@ skipping 177 matching lines @@
       ret = net::ERR_ACCESS_DENIED;
       break;
 
     default:
       DLOG(WARNING)
           << StringPrintf("TODO: translate HRESULT 0x%08X to net::Error", hr);
       break;
   }
   return ret;
 }