If ResourceDispatcherHost receives a CancelRequest, it

should call OnResponseComplete() only if the cancellation
is actually processed.  Otherwise, it might destroy a
request that is still active.

In addition, make sure DownloadRequestLimiter::Callback is
only invoked from the IO thread and prevent
DownloadThrottlingResourceHandler from processing
callbacks after the request has been closed.

BUG=76202
TEST=none

Review URL: http://codereview.chromium.org/6713008

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@78983 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 14 insertions, 7 deletions

diff --git a/content/browser/renderer_host/resource_dispatcher_host.cc b/content/browser/renderer_host/resource_dispatcher_host.cc
index bd9f1ec..936d1d0 100644
--- a/content/browser/renderer_host/resource_dispatcher_host.cc
+++ b/content/browser/renderer_host/resource_dispatcher_host.cc
@@ -1170,14 +1170,17 @@ void ResourceDispatcherHost::CancelRequest(int child_id,
   }
   net::URLRequest* request = i->second;
   const bool started_before_cancel = request->is_pending();
-  CancelRequestInternal(request, from_renderer);
-  // If the request isn't in flight, then we won't get asyncronous notification,
-  // so we have to signal ourselves to finish this request.
-  if (!started_before_cancel)
+
+  if (CancelRequestInternal(request, from_renderer) &&
+      !started_before_cancel) {
+    // If the request isn't in flight, then we won't get asyncronous
+    // notification, so we have to signal ourselves to finish this
+    // request.
     OnResponseCompleted(request);
+  }
 }
 
-void ResourceDispatcherHost::CancelRequestInternal(net::URLRequest* request,
+bool ResourceDispatcherHost::CancelRequestInternal(net::URLRequest* request,
                                                    bool from_renderer) {
   VLOG(1) << "CancelRequest: " << request->url().spec();
 
@@ -1196,11 +1199,13 @@ void ResourceDispatcherHost::CancelRequestInternal(net::URLRequest* request,
     request->Cancel();
     // Our callers assume |request| is valid after we return.
     DCHECK(IsValidRequest(request));
+    return true;
   }
 
   // Do not remove from the pending requests, as the request will still
   // call AllDataReceived, and may even have more data before it does
   // that.
+  return false;
 }
 
 int ResourceDispatcherHost::IncrementOutstandingRequestsMemoryCost(
diff --git a/content/browser/renderer_host/resource_dispatcher_host.h b/content/browser/renderer_host/resource_dispatcher_host.h
index a177719..33757df 100644
--- a/content/browser/renderer_host/resource_dispatcher_host.h
+++ b/content/browser/renderer_host/resource_dispatcher_host.h
@@ -317,8 +317,10 @@ class ResourceDispatcherHost : public net::URLRequest::Delegate {
   // Helper function for regular and download requests.
   void BeginRequestInternal(net::URLRequest* request);
 
-  // Helper function that cancels |request|.
-  void CancelRequestInternal(net::URLRequest* request, bool from_renderer);
+  // Helper function that cancels |request|.  Returns whether the
+  // request was actually cancelled.  If a renderer cancels a request
+  // for a download, we ignore the cancellation.
+  bool CancelRequestInternal(net::URLRequest* request, bool from_renderer);
 
   // Helper function that inserts |request| into the resource queue.
   void InsertIntoResourceQueue(