Index: content/browser/loader/resource_dispatcher_host_impl.cc |
diff --git a/content/browser/loader/resource_dispatcher_host_impl.cc b/content/browser/loader/resource_dispatcher_host_impl.cc |
index d671e2b715abefdc166efd1417e480ffc84f137b..6591b88d6dee64f223a9882c57d7078c36fd104f 100644 |
--- a/content/browser/loader/resource_dispatcher_host_impl.cc |
+++ b/content/browser/loader/resource_dispatcher_host_impl.cc |
@@ -1052,6 +1052,10 @@ void ResourceDispatcherHostImpl::DidFinishLoading(ResourceLoader* loader) { |
RemovePendingRequest(info->GetChildID(), info->GetRequestID()); |
} |
+void ResourceDispatcherHostImpl::LoaderDestroyed(ResourceLoader* loader) { |
+ request_ids_in_use_.erase(loader->GetRequestInfo()->GetGlobalRequestID()); |
+} |
+ |
void ResourceDispatcherHostImpl::OnInit() { |
scheduler_.reset(new ResourceScheduler); |
} |
@@ -1254,6 +1258,14 @@ void ResourceDispatcherHostImpl::BeginRequest( |
int process_type = filter_->process_type(); |
int child_id = filter_->child_id(); |
+ // Reject request id that's currently in use. |
+ if (request_ids_in_use_.count(GlobalRequestID(child_id, request_id))) { |
+ bad_message::ReceivedBadMessage( |
+ filter_, |
+ bad_message::RDH_INVALID_REQUEST_ID); |
+ return; |
+ } |
+ |
// PlzNavigate: reject invalid renderer main resource request. |
if (IsBrowserSideNavigationEnabled() && |
IsResourceTypeFrame(request_data.resource_type) && |
@@ -2291,6 +2303,8 @@ void ResourceDispatcherHostImpl::BeginRequestInternal( |
linked_ptr<ResourceLoader> loader( |
new ResourceLoader(std::move(request), std::move(handler), this)); |
+ request_ids_in_use_.insert(info->GetGlobalRequestID()); |
+ |
GlobalRoutingID id(info->GetGlobalRoutingID()); |
BlockedLoadersMap::const_iterator iter = blocked_loaders_map_.find(id); |
if (iter != blocked_loaders_map_.end()) { |