Kill vestigial transfer requests

content/browser/frame_host/render_frame_host_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_impl.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/command_line.h"
@@ skipping 180 matching lines @@
                      const std::vector<base::FilePath>& file_paths) {
   ChildProcessSecurityPolicyImpl* policy =
       ChildProcessSecurityPolicyImpl::GetInstance();
 
   for (const auto& file : file_paths) {
     if (!policy->CanReadFile(child_id, file))
       policy->GrantReadFile(child_id, file);
   }
 }
 
-void NotifyRenderFrameDetachedOnIO(int render_process_id, int render_frame_id) {
+void NotifyRenderFrameDetachedOnIO(int render_process_id,
+                                   int render_frame_id,
+                                   GlobalRequestID transfer_request_id) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   SharedWorkerServiceImpl::GetInstance()->RenderFrameDetached(render_process_id,
                                                               render_frame_id);
+  if (transfer_request_id.child_id != -1) {

[Charlie Reis, 2016/11/18 04:52:24]

Let's add a comment saying that we need to clean up any outstanding transfers
since they don't otherwise get deleted in CancelRequestsForRoute when the frame
goes away.

+    ResourceDispatcherHostImpl* rdh = ResourceDispatcherHostImpl::Get();
+    DCHECK(rdh);
+    rdh->CancelRequest(transfer_request_id.child_id,
+                       transfer_request_id.request_id);
+  }
 }
 
 }  // namespace
 
 // static
 RenderFrameHost* RenderFrameHost::FromID(int render_process_id,
                                          int render_frame_id) {
   return RenderFrameHostImpl::FromID(render_process_id, render_frame_id);
 }
 
@@ skipping 133 matching lines @@
 }
 
 RenderFrameHostImpl::~RenderFrameHostImpl() {
   // Release the WebUI instances before all else as the WebUI may accesses the
   // RenderFrameHost during cleanup.
   ClearAllWebUI();
 
   GetProcess()->RemoveRoute(routing_id_);
   g_routing_id_frame_map.Get().erase(
       RenderFrameHostID(GetProcess()->GetID(), routing_id_));
+
+  GlobalRequestID transfer_navigation_id;
+  if (navigation_handle_ && navigation_handle_->is_transferring()) {
+    transfer_navigation_id = navigation_handle_->GetGlobalRequestID();
+  }
   BrowserThread::PostTask(BrowserThread::IO, FROM_HERE,
                           base::Bind(&NotifyRenderFrameDetachedOnIO,
-                                     GetProcess()->GetID(), routing_id_));
+                                     GetProcess()->GetID(), routing_id_,
+                                     transfer_navigation_id));
 
   site_instance_->RemoveObserver(this);
 
   if (delegate_ && render_frame_created_)
     delegate_->RenderFrameDeleted(this);
 
   // If this was the last active frame in the SiteInstance, the
   // DecrementActiveFrameCount call will trigger the deletion of the
   // SiteInstance's proxies.
   GetSiteInstance()->DecrementActiveFrameCount();
@@ skipping 2890 matching lines @@
   // There is no pending NavigationEntry in these cases, so pass 0 as the
   // pending_nav_entry_id. If the previous handle was a prematurely aborted
   // navigation loaded via LoadDataWithBaseURL, propagate the entry id.
   return NavigationHandleImpl::Create(
       params.url, frame_tree_node_, is_renderer_initiated,
       params.was_within_same_page, params.is_srcdoc, base::TimeTicks::Now(),
       entry_id_for_data_nav, false);  // started_from_context_menu
 }
 
 }  // namespace content