[subresource_filter] SB throttle can send multiple speculative requests.

components/subresource_filter/content/browser/fake_safe_browsing_database_manager.cc

Index: components/subresource_filter/content/browser/fake_safe_browsing_database_manager.cc
diff --git a/components/subresource_filter/content/browser/fake_safe_browsing_database_manager.cc b/components/subresource_filter/content/browser/fake_safe_browsing_database_manager.cc
index f6526bd7b29b575c4fccaf829eb043d2db9a2613..112a35614b24240d5299a55f3faa2b986ee5acd0 100644
--- a/components/subresource_filter/content/browser/fake_safe_browsing_database_manager.cc
+++ b/components/subresource_filter/content/browser/fake_safe_browsing_database_manager.cc
@@ -32,13 +32,28 @@ bool FakeSafeBrowsingDatabaseManager::CheckUrlForSubresourceFilter(
   if (!url_to_threat_type_.count(url))
     return true;
 
+  // Enforce the invariant that a client will not send multiple requests, with
+  // the subresource filter client implementation.
+  DCHECK(checks_.find(client) == checks_.end());

[engedy, 2017/04/25 22:03:53]

#include "base/logging.h"

[Charlie Harrison, 2017/04/26 14:30:25]

Done.

+  checks_.insert(client);
   content::BrowserThread::PostTask(
       content::BrowserThread::IO, FROM_HERE,
-      base::Bind(&Client::OnCheckBrowseUrlResult, base::Unretained(client), url,
-                 url_to_threat_type_[url], safe_browsing::ThreatMetadata()));
+      base::Bind(&FakeSafeBrowsingDatabaseManager::
+                     OnCheckUrlForSubresourceFilterComplete,
+                 base::Unretained(this), base::Unretained(client), url));
   return false;
 }
 
+void FakeSafeBrowsingDatabaseManager::OnCheckUrlForSubresourceFilterComplete(
+    Client* client,
+    const GURL& url) {
+  // Check to see if the request was cancelled to avoid use-after-free.
+  if (checks_.find(client) == checks_.end())
+    return;
+  client->OnCheckBrowseUrlResult(url, url_to_threat_type_[url],
+                                 safe_browsing::ThreatMetadata());
+}
+
 bool FakeSafeBrowsingDatabaseManager::CheckResourceUrl(const GURL& url,
                                                        Client* client) {
   return true;
@@ -50,7 +65,9 @@ bool FakeSafeBrowsingDatabaseManager::IsSupported() const {
 bool FakeSafeBrowsingDatabaseManager::ChecksAreAlwaysAsync() const {
   return false;
 }
-void FakeSafeBrowsingDatabaseManager::CancelCheck(Client* client) {}
+void FakeSafeBrowsingDatabaseManager::CancelCheck(Client* client) {
+  checks_.erase(client);
+}
 bool FakeSafeBrowsingDatabaseManager::CanCheckResourceType(
     content::ResourceType /* resource_type */) const {
   return true;