diff options
| author | zelidrag@chromium.org <zelidrag@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2011-01-12 17:02:09 +0000 |
|---|---|---|
| committer | zelidrag@chromium.org <zelidrag@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2011-01-12 17:02:09 +0000 |
| commit | 0a73924225a4991833f60000631df5dd1f3179d9 (patch) | |
| tree | c89f69d86f2a1786538cd4a63d26f1de44d36b68 | |
| parent | 72f891f407cc2ccd132328e97f1b4dd5eaab72b2 (diff) | |
| download | chromium_src-0a73924225a4991833f60000631df5dd1f3179d9.zip chromium_src-0a73924225a4991833f60000631df5dd1f3179d9.tar.gz chromium_src-0a73924225a4991833f60000631df5dd1f3179d9.tar.bz2 | |
Fixed crash caused by ResourceDispatcher::OnReceivedRedirect() indirectly running a nested mesage loop in request_info->peer->OnReceivedRedirect() call. The loop might kill the instance of PendingRequestInfo what caused this crash. The fix simply checks for validity of PendingRequestInfo one more time within this OnReceivedRedirect() method.
BUG=chromium:65345, chromium-os:10721
TEST=sign up with gmail, try to switch account to another one - there should be no crash. see http://crosbug.com/10721 for more detailed repro steps
Review URL: http://codereview.chromium.org/6211005
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@71180 0039d316-1c4b-4281-b951-d872f2087c98
| -rw-r--r-- | chrome/common/resource_dispatcher.cc | 5 | ||||
| -rw-r--r-- | chrome/test/data/import/firefox/linux.zip | bin | 12814630 -> 9584640 bytes |
2 files changed, 5 insertions, 0 deletions
diff --git a/chrome/common/resource_dispatcher.cc b/chrome/common/resource_dispatcher.cc index e4747b9..bcb4644 100644 --- a/chrome/common/resource_dispatcher.cc +++ b/chrome/common/resource_dispatcher.cc @@ -402,6 +402,11 @@ void ResourceDispatcher::OnReceivedRedirect( if (request_info->peer->OnReceivedRedirect(new_url, info, &has_new_first_party_for_cookies, &new_first_party_for_cookies)) { + // Double-check if the request is still around. The call above could + // potentially remove it. + request_info = GetPendingRequestInfo(request_id); + if (!request_info) + return; request_info->pending_redirect_message.reset( new ViewHostMsg_FollowRedirect(routing_id, request_id, has_new_first_party_for_cookies, diff --git a/chrome/test/data/import/firefox/linux.zip b/chrome/test/data/import/firefox/linux.zip Binary files differindex e4cf00c..b5eead1 100644 --- a/chrome/test/data/import/firefox/linux.zip +++ b/chrome/test/data/import/firefox/linux.zip |