diff options
| author | simonjam@chromium.org <simonjam@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2011-12-06 23:41:10 +0000 |
|---|---|---|
| committer | simonjam@chromium.org <simonjam@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2011-12-06 23:41:10 +0000 |
| commit | 8027e74b77efdfc1a64c7a8744b79eab779853c8 (patch) | |
| tree | 14a551d3641de312dfb1ad2f38cd65ee20da2c18 /chrome/browser | |
| parent | 539c0e7553c1a93f36669df690ebc07fb253de8a (diff) | |
| download | chromium_src-8027e74b77efdfc1a64c7a8744b79eab779853c8.zip chromium_src-8027e74b77efdfc1a64c7a8744b79eab779853c8.tar.gz chromium_src-8027e74b77efdfc1a64c7a8744b79eab779853c8.tar.bz2 | |
Fix race between OnPipelineFeedback and
HttpStreamFactoryImpl::Job::OnStreamReadyCallback.
As a side-effect of OnPipelineFeedback() calling OnPipelineHasCapacity() on all
of the pipelines, some requests are late-bound to existing pipelines with
capacity. However, those requests may have been in the process of establishing
new pipelines. By stealing those requests, the new pipelines become empty and
are deleted. Later iterations of the loop in OnPipelineFeedback() weren't
careful about checking to see if the pipeline was deleted before calling
OnPipelineHasCapacity() on it.
BUG=106313
TEST=net_unittests under valgrind
Review URL: http://codereview.chromium.org/8820005
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@113287 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'chrome/browser')
0 files changed, 0 insertions, 0 deletions