Cronet Fix Channel Write after Close when request is canceled after success.

components/cronet/android/url_request_adapter.cc

Index: components/cronet/android/url_request_adapter.cc
diff --git a/components/cronet/android/url_request_adapter.cc b/components/cronet/android/url_request_adapter.cc
index 5d8f84965fc9c59dc616399aa77d4637234728f8..a136a2e16d5551bd765a1335aa8989fcc54df7e1 100644
--- a/components/cronet/android/url_request_adapter.cc
+++ b/components/cronet/android/url_request_adapter.cc
@@ -22,7 +22,7 @@
 
 namespace cronet {
 
-static const size_t kBufferSizeIncrement = 8192;
+static const size_t kBufferSizeIncrement = 32768;

[mmenke, 2014/12/04 20:57:29]

No longer incrementing.  kReadBufferSize?

[mef, 2014/12/05 23:25:07]

Done.

 
 URLRequestAdapter::URLRequestAdapter(URLRequestContextAdapter* context,
                                      URLRequestAdapterDelegate* delegate,
@@ -30,7 +30,6 @@ URLRequestAdapter::URLRequestAdapter(URLRequestContextAdapter* context,
                                      net::RequestPriority priority)
     : method_("GET"),
       read_buffer_(new net::GrowableIOBuffer()),
-      bytes_read_(0),
       total_bytes_read_(0),
       error_code_(0),
       http_status_code_(0),
@@ -171,12 +170,6 @@ void URLRequestAdapter::OnInitiateConnection() {
 }
 
 void URLRequestAdapter::Cancel() {
-  if (canceled_) {
-    return;
-  }
-
-  canceled_ = true;
-
   context_->PostTaskToNetworkThread(
       FROM_HERE,
       base::Bind(&URLRequestAdapter::OnCancelRequest, base::Unretained(this)));
@@ -185,12 +178,15 @@ void URLRequestAdapter::Cancel() {
 void URLRequestAdapter::OnCancelRequest() {
   DCHECK(OnNetworkThread());
   VLOG(1) << "Canceling chromium request: " << url_.possibly_invalid_spec();
+  if (canceled_)
+    return;
+  canceled_ = true;
+  // Check whether request has already completed.
+  if (url_request_ == nullptr)
+    return;
 
-  if (url_request_ != NULL) {
-    url_request_->Cancel();
-  }
-
-  OnRequestCanceled();
+  url_request_->Cancel();
+  OnRequestCompleted();
 }
 
 void URLRequestAdapter::Destroy() {
@@ -231,54 +227,45 @@ void URLRequestAdapter::OnResponseStarted(net::URLRequest* request) {
 // Reads all available data or starts an asynchronous read.
 void URLRequestAdapter::Read() {
   DCHECK(OnNetworkThread());
-  while (true) {
-    if (read_buffer_->RemainingCapacity() == 0) {
-      int new_capacity = read_buffer_->capacity() + kBufferSizeIncrement;
-      read_buffer_->SetCapacity(new_capacity);
-    }
-
-    int bytes_read;
-    if (url_request_->Read(read_buffer_.get(),
-                           read_buffer_->RemainingCapacity(),
-                           &bytes_read)) {
-      if (bytes_read == 0) {
-        OnRequestSucceeded();
-        break;
-      }
-
-      VLOG(1) << "Synchronously read: " << bytes_read << " bytes";
-      OnBytesRead(bytes_read);
-    } else if (url_request_->status().status() ==
-               net::URLRequestStatus::IO_PENDING) {
-      if (bytes_read_ != 0) {
-        VLOG(1) << "Flushing buffer: " << bytes_read_ << " bytes";
-
-        delegate_->OnBytesRead(this);
-        read_buffer_->set_offset(0);
-        bytes_read_ = 0;
-      }
-      VLOG(1) << "Started async read";
-      break;
-    } else {
-      OnRequestFailed();
-      break;
-    }
+  if (read_buffer_->RemainingCapacity() == 0) {

[mmenke, 2014/12/04 20:57:29]

Instead of this, can we just create a fixed buffer here, and replace with with
"if (!read_buffer_) {
  // create buffer here.
}

[mef, 2014/12/05 23:25:07]

Done.

+    int new_capacity = read_buffer_->capacity() + kBufferSizeIncrement;
+    read_buffer_->SetCapacity(new_capacity);
   }
+
+  int bytes_read = 0;
+  do {
+    bytes_read = 0;
+    url_request_->Read(
+        read_buffer_.get(), read_buffer_->RemainingCapacity(), &bytes_read);

[mmenke, 2014/12/04 20:57:29]

read_buffer_->RemainingCapacity -> kBufferSizeIncrement?

[mef, 2014/12/05 23:25:07]

Done.

+    // If IO is pending, wait for the URLRequest to call OnReadCompleted.
+    if (url_request_->status().is_io_pending())
+      return;
+  } while (HandleReadResult(url_request_.get(), bytes_read));
 }
 
-void URLRequestAdapter::OnReadCompleted(net::URLRequest* request,
-                                        int bytes_read) {
+bool URLRequestAdapter::HandleReadResult(net::URLRequest* request,
+                                         int bytes_read) {
   DCHECK(OnNetworkThread());
-  VLOG(1) << "Asynchronously read: " << bytes_read << " bytes";
-  if (bytes_read < 0) {
+  if (!url_request_->status().is_success()) {
     OnRequestFailed();
-    return;
+    return false;
   } else if (bytes_read == 0) {
     OnRequestSucceeded();
+    return false;
+ }

[mmenke, 2014/12/04 20:57:29]

Fix indent.

[mef, 2014/12/05 23:25:07]

Done.

+
+  total_bytes_read_ += bytes_read;
+  delegate_->OnBytesRead(this, bytes_read);
+  read_buffer_->set_offset(0);

[mmenke, 2014/12/04 20:57:29]

I don't think this does anything?  Once this is removed, we can stop using
GrowableIOBuffer, too.

[mef, 2014/12/05 23:25:07]

Done.

+
+  return true;
+}
+
+void URLRequestAdapter::OnReadCompleted(net::URLRequest* request,
+                                        int bytes_read) {
+  if (!HandleReadResult(request, bytes_read))
     return;
-  }
 
-  OnBytesRead(bytes_read);
   Read();
 }
 
@@ -296,13 +283,6 @@ void URLRequestAdapter::OnReceivedRedirect(net::URLRequest* request,
   }
 }
 
-void URLRequestAdapter::OnBytesRead(int bytes_read) {
-  DCHECK(OnNetworkThread());
-  read_buffer_->set_offset(read_buffer_->offset() + bytes_read);
-  bytes_read_ += bytes_read;
-  total_bytes_read_ += bytes_read;
-}
-
 void URLRequestAdapter::OnRequestSucceeded() {
   DCHECK(OnNetworkThread());
   if (canceled_) {
@@ -327,16 +307,12 @@ void URLRequestAdapter::OnRequestFailed() {
   OnRequestCompleted();
 }
 
-void URLRequestAdapter::OnRequestCanceled() {
-  DCHECK(OnNetworkThread());
-  OnRequestCompleted();
-}
-
 void URLRequestAdapter::OnRequestCompleted() {
   DCHECK(OnNetworkThread());
   VLOG(1) << "Completed: " << url_.possibly_invalid_spec();
 
-  delegate_->OnBytesRead(this);
+  DCHECK(url_request_ != nullptr);
+
   delegate_->OnRequestFinished(this);
   url_request_.reset();
 }