Chromium Code Reviews Chromium Code Reviews
Issue 2459483002:
[Mojo-Loading] Dispatch body data after response is received (Closed)
| OLD | NEW |
|---|---|
| 1 // Copyright 2016 The Chromium Authors. All rights reserved. | 1 // Copyright 2016 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "content/child/url_response_body_consumer.h" | 5 #include "content/child/url_response_body_consumer.h" |
| 6 | 6 |
| 7 #include "base/bind.h" | 7 #include "base/bind.h" |
| 8 #include "base/macros.h" | 8 #include "base/macros.h" |
| 9 #include "base/memory/ptr_util.h" | 9 #include "base/memory/ptr_util.h" |
| 10 #include "content/child/resource_dispatcher.h" | 10 #include "content/child/resource_dispatcher.h" |
| (...skipping 31 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 42 | 42 |
| 43 URLResponseBodyConsumer::URLResponseBodyConsumer( | 43 URLResponseBodyConsumer::URLResponseBodyConsumer( |
| 44 int request_id, | 44 int request_id, |
| 45 ResourceDispatcher* resource_dispatcher, | 45 ResourceDispatcher* resource_dispatcher, |
| 46 mojo::ScopedDataPipeConsumerHandle handle, | 46 mojo::ScopedDataPipeConsumerHandle handle, |
| 47 scoped_refptr<base::SingleThreadTaskRunner> task_runner) | 47 scoped_refptr<base::SingleThreadTaskRunner> task_runner) |
| 48 : request_id_(request_id), | 48 : request_id_(request_id), |
| 49 resource_dispatcher_(resource_dispatcher), | 49 resource_dispatcher_(resource_dispatcher), |
| 50 handle_(std::move(handle)), | 50 handle_(std::move(handle)), |
| 51 handle_watcher_(task_runner), | 51 handle_watcher_(task_runner), |
| 52 has_seen_end_of_data_(!handle_.is_valid()) { | 52 has_seen_end_of_data_(!handle_.is_valid()) {} |
| 53 | |
| 54 URLResponseBodyConsumer::~URLResponseBodyConsumer() {} | |
| 55 | |
| 56 void URLResponseBodyConsumer::Start(base::SingleThreadTaskRunner* task_runner) { | |
| 57 if (has_been_cancelled_) | |
| 58 return; | |
| 53 handle_watcher_.Start( | 59 handle_watcher_.Start( |
| 54 handle_.get(), MOJO_HANDLE_SIGNAL_READABLE, | 60 handle_.get(), MOJO_HANDLE_SIGNAL_READABLE, |
| 55 base::Bind(&URLResponseBodyConsumer::OnReadable, base::Unretained(this))); | 61 base::Bind(&URLResponseBodyConsumer::OnReadable, base::Unretained(this))); |
| 56 task_runner->PostTask( | 62 task_runner->PostTask( |
| 57 FROM_HERE, base::Bind(&URLResponseBodyConsumer::OnReadable, AsWeakPtr(), | 63 FROM_HERE, base::Bind(&URLResponseBodyConsumer::OnReadable, AsWeakPtr(), |
| 58 MOJO_RESULT_OK)); | 64 MOJO_RESULT_OK)); |
| 59 } | 65 } |
| 60 | 66 |
| 61 URLResponseBodyConsumer::~URLResponseBodyConsumer() {} | |
| 62 | |
| 63 void URLResponseBodyConsumer::OnComplete( | 67 void URLResponseBodyConsumer::OnComplete( |
| 64 const ResourceRequestCompletionStatus& status) { | 68 const ResourceRequestCompletionStatus& status) { |
| 65 if (has_been_cancelled_) | 69 if (has_been_cancelled_) |
| 66 return; | 70 return; |
| 67 has_received_completion_ = true; | 71 has_received_completion_ = true; |
| 68 completion_status_ = status; | 72 completion_status_ = status; |
| 69 NotifyCompletionIfAppropriate(); | 73 NotifyCompletionIfAppropriate(); |
| 70 } | 74 } |
| 71 | 75 |
| 72 void URLResponseBodyConsumer::Cancel() { | 76 void URLResponseBodyConsumer::Cancel() { |
| 73 has_been_cancelled_ = true; | 77 has_been_cancelled_ = true; |
| 74 handle_watcher_.Cancel(); | 78 handle_watcher_.Cancel(); |
| 75 } | 79 } |
| 76 | 80 |
| 77 void URLResponseBodyConsumer::Reclaim(uint32_t size) { | 81 void URLResponseBodyConsumer::Reclaim(uint32_t size) { |
| 78 MojoResult result = mojo::EndReadDataRaw(handle_.get(), size); | 82 MojoResult result = mojo::EndReadDataRaw(handle_.get(), size); |
| 79 DCHECK_EQ(MOJO_RESULT_OK, result); | 83 DCHECK_EQ(MOJO_RESULT_OK, result); |
| 80 } | 84 } |
| 81 | 85 |
| 82 void URLResponseBodyConsumer::OnReadable(MojoResult unused) { | 86 void URLResponseBodyConsumer::OnReadable(MojoResult unused) { |
| 83 if (has_been_cancelled_ || has_seen_end_of_data_) | 87 if (has_been_cancelled_ || has_seen_end_of_data_) |
| 84 return; | 88 return; |
| 85 | 89 |
| 86 // TODO(yhirano): Suppress notification when deferred. | 90 // TODO(yhirano): Suppress notification when deferred. |
| 87 while (!has_been_cancelled_) { | 91 while (!has_been_cancelled_) { |
|
tapted
2016/11/04 08:44:06
So the UAF is actually down here, so https://coder
| |
| 88 const void* buffer = nullptr; | 92 const void* buffer = nullptr; |
| 89 uint32_t available = 0; | 93 uint32_t available = 0; |
| 90 MojoResult result = mojo::BeginReadDataRaw( | 94 MojoResult result = mojo::BeginReadDataRaw( |
| 91 handle_.get(), &buffer, &available, MOJO_READ_DATA_FLAG_NONE); | 95 handle_.get(), &buffer, &available, MOJO_READ_DATA_FLAG_NONE); |
| 92 if (result == MOJO_RESULT_SHOULD_WAIT) | 96 if (result == MOJO_RESULT_SHOULD_WAIT) |
| 93 return; | 97 return; |
| 94 if (result == MOJO_RESULT_FAILED_PRECONDITION) { | 98 if (result == MOJO_RESULT_FAILED_PRECONDITION) { |
| 95 has_seen_end_of_data_ = true; | 99 has_seen_end_of_data_ = true; |
| 96 NotifyCompletionIfAppropriate(); | 100 NotifyCompletionIfAppropriate(); |
| 97 return; | 101 return; |
| (...skipping 20 matching lines...) Expand all Loading... | |
| 118 return; | 122 return; |
| 119 // Cancel this instance in order not to notify twice. | 123 // Cancel this instance in order not to notify twice. |
| 120 Cancel(); | 124 Cancel(); |
| 121 | 125 |
| 122 resource_dispatcher_->OnMessageReceived( | 126 resource_dispatcher_->OnMessageReceived( |
| 123 ResourceMsg_RequestComplete(request_id_, completion_status_)); | 127 ResourceMsg_RequestComplete(request_id_, completion_status_)); |
| 124 // |this| may be deleted. | 128 // |this| may be deleted. |
| 125 } | 129 } |
| 126 | 130 |
| 127 } // namespace content | 131 } // namespace content |
| OLD | NEW |
