AppCache: fix a browser crashing bug that can happen during updates.

content/browser/appcache/appcache_update_job.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/appcache/appcache_update_job.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/compiler_specific.h"
 #include "base/strings/string_util.h"
@@ skipping 388 matching lines @@
       weak_factory_(this) {
     service_->AddObserver(this);
 }
 
 AppCacheUpdateJob::~AppCacheUpdateJob() {
   if (service_)
     service_->RemoveObserver(this);
   if (internal_state_ != COMPLETED)
     Cancel();
 
-  DCHECK(!manifest_fetcher_);
-  DCHECK(pending_url_fetches_.empty());
   DCHECK(!inprogress_cache_.get());
   DCHECK(pending_master_entries_.empty());
-  DCHECK(master_entry_fetches_.empty());
+
+  // The job must not outlive any of its fetchers.
+  CHECK(!manifest_fetcher_);
+  CHECK(pending_url_fetches_.empty());
+  CHECK(master_entry_fetches_.empty());
 
   if (group_)
     group_->SetUpdateAppCacheStatus(AppCacheGroup::IDLE);
 }
 
 void AppCacheUpdateJob::StartUpdate(AppCacheHost* host,
                                     const GURL& new_master_resource) {
   DCHECK(group_->update_job() == this);
   DCHECK(!group_->is_obsolete());
 
   bool is_new_pending_master_entry = false;
   if (!new_master_resource.is_empty()) {
     DCHECK(new_master_resource == host->pending_master_entry_url());
     DCHECK(!new_master_resource.has_ref());
     DCHECK(new_master_resource.GetOrigin() == manifest_url_.GetOrigin());
 
+    if (ContainsKey(failed_master_entries_, new_master_resource))
+      return;
+
     // Cannot add more to this update if already terminating.
     if (IsTerminating()) {
       group_->QueueUpdate(host, new_master_resource);
       return;
     }
 
     std::pair<PendingMasters::iterator, bool> ret =
         pending_master_entries_.insert(
             PendingMasters::value_type(new_master_resource, PendingHosts()));
     is_new_pending_master_entry = ret.second;
@@ skipping 417 matching lines @@
       host_notifier.AddHost(host);
 
       // In downloading case, disassociate host from inprogress cache.
       if (inprogress_cache_.get())
         host->AssociateNoCache(GURL());
 
       host->RemoveObserver(this);
     }
     hosts.clear();
 
+    failed_master_entries_.insert(url);
+
     const char* kFormatString = "Manifest fetch failed (%d) %s";
     std::string message = FormatUrlErrorMessage(
         kFormatString, request->url(), fetcher->result(), response_code);
     host_notifier.SendErrorNotifications(
         AppCacheErrorDetails(message,
                      APPCACHE_MANIFEST_ERROR,
                      request->url(),
                      response_code,
                      false /*is_cross_origin*/));
 
@@ skipping 822 matching lines @@
   // on this object after we've posted a task to delete ourselves.
   if (group_) {
     group_->SetUpdateAppCacheStatus(AppCacheGroup::IDLE);
     group_ = NULL;
   }
 
   base::MessageLoop::current()->DeleteSoon(FROM_HERE, this);
 }
 
 }  // namespace content