Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(20)

Issue 2784143003: Fix a potential infinite loop in HttpStreamFactoryImpl when a new SpdySession is established (Closed)

Created:
3 years, 8 months ago by xunjieli
Modified:
3 years, 8 months ago
Reviewers:
Bence, mmenke
CC:
chromium-reviews, cbentzel+watch_chromium.org, net-reviews_chromium.org
Target Ref:
refs/heads/master
Project:
chromium
Visibility:
Public.

Description

Fix a potential infinite loop in HttpStreamFactoryImpl when a new SpdySession is established When a new SpdySession is created, we iterate through |spdy_session_request_map_| and notify all pending requests (HttpStreamFactoryImpl::OnNewSpdySessionReady). We will enter an infinite loop here because the iteration doesn't guarantee to update |spdy_session_request_map_| container, contrary to what the comments say. The Request destructor removes itself from |spdy_session_request_map_|. However, if the owner of Request doesn't destroy the Request in OnStreamReady() callback, we will be in trouble. HttpNetworkTransaction always destroys the Request in OnStreamReady() callback, so we do not run into this situation in practice. I think the RemoveRequestFromSpdySessionRequestMap() should be directly invoked by the FactoryImpl, instead of indirectly through Request destructor and the Controller. This CL adds a regression test which will trigger the infinite loop in release build. BUG=706974

Patch Set 1 : self #

Patch Set 2 : rebased #

Patch Set 3 : rebased #

Total comments: 12

Patch Set 4 : fix one more test #

Patch Set 5 : Address comments #

Unified diffs Side-by-side diffs Delta from patch set Stats (+106 lines, -67 lines) Patch
M net/http/http_stream_factory_impl.h View 1 1 chunk +4 lines, -0 lines 0 comments Download
M net/http/http_stream_factory_impl.cc View 1 2 3 4 2 chunks +19 lines, -2 lines 0 comments Download
M net/http/http_stream_factory_impl_job_controller.h View 1 1 chunk +0 lines, -3 lines 0 comments Download
M net/http/http_stream_factory_impl_job_controller.cc View 1 2 3 4 4 chunks +13 lines, -26 lines 0 comments Download
M net/http/http_stream_factory_impl_request.h View 1 chunk +0 lines, -2 lines 0 comments Download
M net/http/http_stream_factory_impl_request.cc View 1 chunk +0 lines, -6 lines 0 comments Download
M net/http/http_stream_factory_impl_unittest.cc View 1 2 3 13 chunks +70 lines, -28 lines 0 comments Download

Messages

Total messages: 38 (34 generated)
xunjieli
This is a bit ugly. Let me know if you have any suggestion.
3 years, 8 months ago (2017-03-31 15:04:06 UTC) #19
Bence
https://codereview.chromium.org/2784143003/diff/140001/net/http/http_stream_factory_impl.cc File net/http/http_stream_factory_impl.cc (right): https://codereview.chromium.org/2784143003/diff/140001/net/http/http_stream_factory_impl.cc#newcode253 net/http/http_stream_factory_impl.cc:253: if (!base::ContainsKey(spdy_session_request_map_, spdy_session_key)) Once you are here, consider removing ...
3 years, 8 months ago (2017-03-31 16:21:27 UTC) #32
xunjieli
https://codereview.chromium.org/2784143003/diff/140001/net/http/http_stream_factory_impl.cc File net/http/http_stream_factory_impl.cc (right): https://codereview.chromium.org/2784143003/diff/140001/net/http/http_stream_factory_impl.cc#newcode253 net/http/http_stream_factory_impl.cc:253: if (!base::ContainsKey(spdy_session_request_map_, spdy_session_key)) On 2017/03/31 16:21:27, Bence wrote: > ...
3 years, 8 months ago (2017-03-31 17:45:26 UTC) #35
xunjieli
3 years, 8 months ago (2017-03-31 19:13:45 UTC) #38
Abandoning this CL. This is much harder than I thought. In particular, if we
have also have an alt Spdy job pointing to a different host/port, we will be
calling SetSpdySessionKey() with two different keys on the same Impl::Request.
The second SetSpdySessonKey() is an no-op, so if the second job succeeds, we
will fail to notify pending Requests.
This will probably be a problem when H2 connection pooling is
implemented/enabled.

Powered by Google App Engine
This is Rietveld 408576698