Fix a browser crash during cache validation.

It is possible for a crazy server to return 206 even
though we are not making a range request. In that
case, we should not allow the stored response to go
through the logic for range support (which right now
is disabled). We've always stored those 206s though.

BUG=15617
TEST=unittest

Review URL: http://codereview.chromium.org/150090

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@19621 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 34 insertions, 0 deletions

diff --git a/net/http/http_cache.cc b/net/http/http_cache.cc
index d56d1db..9c9043e 100644
--- a/net/http/http_cache.cc
+++ b/net/http/http_cache.cc
@@ -780,6 +780,10 @@ int HttpCache::Transaction::BeginPartialCacheValidation() {
   if (response_.headers->response_code() != 206)
     return BeginCacheValidation();
 
+#if !defined(ENABLE_RANGE_SUPPORT)
+  return BeginCacheValidation();
+#endif
+
   if (!partial_.get()) {
     // The request is not for a range, but we have stored just ranges.
     // TODO(rvargas): Add support for this case.
@@ -889,6 +893,12 @@ bool HttpCache::Transaction::RequiresValidation() {
 bool HttpCache::Transaction::ConditionalizeRequest() {
   DCHECK(response_.headers);
 
+#if !defined(ENABLE_RANGE_SUPPORT)
+  // This only makes sense for cached 200 responses.
+  if (response_.headers->response_code() != 200)
+    return false;
+#endif
+
   // This only makes sense for cached 200 or 206 responses.
   if (response_.headers->response_code() != 200 &&
       response_.headers->response_code() != 206)
diff --git a/net/http/http_cache_unittest.cc b/net/http/http_cache_unittest.cc
index e72a871..1c74ca8 100644
--- a/net/http/http_cache_unittest.cc
+++ b/net/http/http_cache_unittest.cc
@@ -1189,6 +1189,30 @@ TEST(HttpCache, RangeGET_SkipsCache) {
   EXPECT_EQ(0, cache.disk_cache()->create_count());
 }
 
+TEST(HttpCache, GET_Crazy206) {
+  MockHttpCache cache;
+  AddMockTransaction(&kRangeGET_TransactionOK);
+
+  // Test that receiving 206 for a regular request is handled correctly.
+
+  // Write to the cache.
+  MockTransaction transaction(kRangeGET_TransactionOK);
+  transaction.request_headers = "";
+  RunTransactionTest(cache.http_cache(), transaction);
+
+  EXPECT_EQ(1, cache.network_layer()->transaction_count());
+  EXPECT_EQ(0, cache.disk_cache()->open_count());
+  EXPECT_EQ(1, cache.disk_cache()->create_count());
+
+  // This should read again from the net.
+  RunTransactionTest(cache.http_cache(), transaction);
+
+  EXPECT_EQ(2, cache.network_layer()->transaction_count());
+  EXPECT_EQ(1, cache.disk_cache()->open_count());
+  EXPECT_EQ(1, cache.disk_cache()->create_count());
+  RemoveMockTransaction(&kRangeGET_TransactionOK);
+}
+
 TEST(HttpCache, DISABLED_RangeGET_OK) {
   MockHttpCache cache;
   AddMockTransaction(&kRangeGET_TransactionOK);