Fix for a race issue when chrome decides that a request needs to be downloaded by the host browser.

Before the request could under some circumstances be terminated before we handed it over to the host for download.
In such cases we would just drop the request and not download anything.

TEST=Fixes flakyness of _some_ download scenarios.  This is only a part of a fix needed for the related bug.
BUG=36694

Review URL: http://codereview.chromium.org/1240004

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@42673 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 18 insertions, 5 deletions

diff --git a/chrome_frame/chrome_frame_activex_base.h b/chrome_frame/chrome_frame_activex_base.h
index 7240dbe..d29eb65 100644
--- a/chrome_frame/chrome_frame_activex_base.h
+++ b/chrome_frame/chrome_frame_activex_base.h
@@ -41,6 +41,7 @@
 #include "chrome_frame/com_type_info_holder.h"
 #include "chrome_frame/simple_resource_loader.h"
 #include "chrome_frame/urlmon_url_request.h"
+#include "chrome_frame/urlmon_url_request_private.h"
 #include "chrome/common/url_constants.h"
 #include "grit/generated_resources.h"
 #include "net/base/cookie_monster.h"
@@ -213,6 +214,7 @@ END_CONNECTION_POINT_MAP()
 
 BEGIN_MSG_MAP(ChromeFrameActivexBase)
   MESSAGE_HANDLER(WM_CREATE, OnCreate)
+  MESSAGE_HANDLER(WM_DOWNLOAD_IN_HOST, OnDownloadRequestInHost)
   MESSAGE_HANDLER(WM_DESTROY, OnDestroy)
   CHAIN_MSG_MAP(ChromeFramePlugin<T>)
   CHAIN_MSG_MAP(CComControl<T>)
@@ -402,16 +404,27 @@ END_MSG_MAP()
     HostNavigate(url_to_open, referrer, open_disposition);
   }
 
-  virtual void OnDownloadRequestInHost(int tab_handle, int request_id) {
-    DLOG(INFO) << "Let the host browser handle this download";
-    ScopedComPtr<IBindCtx> bind_context;
-    ScopedComPtr<IMoniker> moniker;
-    url_fetcher_.StealMonikerFromRequest(request_id, moniker.Receive());
+  // Called when Chrome has decided that a request needs to be treated as a
+  // download.  The caller will be the UrlRequest worker thread.
+  // The worker thread will block while we process the request and take
+  // ownership of the request object.
+  // There's room for improvement here and also see todo below.
+  LPARAM OnDownloadRequestInHost(UINT message, WPARAM wparam, LPARAM lparam,
+                                 BOOL& handled) {
+    ScopedComPtr<IMoniker> moniker(reinterpret_cast<IMoniker*>(lparam));
+    DCHECK(moniker);
+    // TODO(tommi): It looks like we might have to switch the request object
+    // into a pass-through request object and serve up any thus far received
+    // content and headers to IE in order to prevent what can currently happen
+    // which is reissuing requests and turning POST into GET.
     if (moniker) {
+      ScopedComPtr<IBindCtx> bind_context;
       ::CreateBindCtx(0, bind_context.Receive());
       DCHECK(bind_context);
       NavigateBrowserToMoniker(doc_site_, moniker, NULL, bind_context, NULL);
     }
+
+    return TRUE;
   }
 
   virtual void OnSetCookieAsync(int tab_handle, const GURL& url,