DescriptionFix race between OnPipelineFeedback and
HttpStreamFactoryImpl::Job::OnStreamReadyCallback.
As a side-effect of OnPipelineFeedback() calling OnPipelineHasCapacity() on all
of the pipelines, some requests are late-bound to existing pipelines with
capacity. However, those requests may have been in the process of establishing
new pipelines. By stealing those requests, the new pipelines become empty and
are deleted. Later iterations of the loop in OnPipelineFeedback() weren't
careful about checking to see if the pipeline was deleted before calling
OnPipelineHasCapacity() on it.
BUG=106313
TEST=net_unittests under valgrind
Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=113287
Patch Set 1 #
Total comments: 5
Patch Set 2 : Added comment #Patch Set 3 : Fix Win build #
Messages
Total messages: 7 (0 generated)
|