Fix race between OnPipelineFeedback and

HttpStreamFactoryImpl::Job::OnStreamReadyCallback.

As a side-effect of OnPipelineFeedback() calling OnPipelineHasCapacity() on all
of the pipelines, some requests are late-bound to existing pipelines with
capacity. However, those requests may have been in the process of establishing
new pipelines. By stealing those requests, the new pipelines become empty and
are deleted. Later iterations of the loop in OnPipelineFeedback() weren't
careful about checking to see if the pipeline was deleted before calling
OnPipelineHasCapacity() on it.

BUG=106313
TEST=net_unittests under valgrind


Review URL: http://codereview.chromium.org/8820005

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@113287 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 9 insertions, 0 deletions

diff --git a/net/http/http_pipelined_host_impl.h b/net/http/http_pipelined_host_impl.h
index f74de88..c1d745c 100644
--- a/net/http/http_pipelined_host_impl.h
+++ b/net/http/http_pipelined_host_impl.h
@@ -85,6 +85,15 @@ class NET_EXPORT_PRIVATE HttpPipelinedHostImpl
   // not be called if |capability_| is INCAPABLE.
   int GetPipelineCapacity() const;
 
+  // Returns true if |pipeline| can handle a new request. This is true if the
+  // |pipeline| is active, usable, has capacity, and |capability_| is
+  // sufficient.
+  bool CanPipelineAcceptRequests(HttpPipelinedConnection* pipeline) const;
+
+  // Called when |this| moves from UNKNOWN |capability_| to PROBABLY_CAPABLE.
+  // Causes all pipelines to increase capacity to start pipelining.
+  void NotifyAllPipelinesHaveCapacity();
+
   HttpPipelinedHost::Delegate* delegate_;
   const HostPortPair origin_;
   PipelineInfoMap pipelines_;