diff options
| author | ricea@chromium.org <ricea@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2014-07-24 10:48:16 +0000 |
|---|---|---|
| committer | ricea@chromium.org <ricea@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2014-07-24 10:48:16 +0000 |
| commit | fe9beab7b9e4e30cc09cfb68ebe6b7a989dfe06b (patch) | |
| tree | abaac76c0d8097e41e9f2d162609b2e6a95df1f9 /net/socket/websocket_transport_client_socket_pool.cc | |
| parent | d77baf89f9ad0ca243aae70c623e2783deb04f76 (diff) | |
| download | chromium_src-fe9beab7b9e4e30cc09cfb68ebe6b7a989dfe06b.zip chromium_src-fe9beab7b9e4e30cc09cfb68ebe6b7a989dfe06b.tar.gz chromium_src-fe9beab7b9e4e30cc09cfb68ebe6b7a989dfe06b.tar.bz2 | |
Fix WebSocket race between close and connect.
If the WebSocket handshake was cancelled immediately after the connect
succeeded before the ClientSocketHandle was fully initialised, then the
socket would not be released back to the pool, and as a result the
endpoint would not be unlocked.
Fix by actively reclaiming the socket in
WebSocketTransportClientSocketPool::CancelRequest().
Also add a test for this condition.
BUG=394268, 389084
TEST=net_unittests
Review URL: https://codereview.chromium.org/394113003
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@285175 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'net/socket/websocket_transport_client_socket_pool.cc')
| -rw-r--r-- | net/socket/websocket_transport_client_socket_pool.cc | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/net/socket/websocket_transport_client_socket_pool.cc b/net/socket/websocket_transport_client_socket_pool.cc index 131a966..6486520 100644 --- a/net/socket/websocket_transport_client_socket_pool.cc +++ b/net/socket/websocket_transport_client_socket_pool.cc @@ -360,8 +360,12 @@ void WebSocketTransportClientSocketPool::RequestSockets( void WebSocketTransportClientSocketPool::CancelRequest( const std::string& group_name, ClientSocketHandle* handle) { + DCHECK(!handle->is_initialized()); if (DeleteStalledRequest(handle)) return; + scoped_ptr<StreamSocket> socket = handle->PassSocket(); + if (socket) + ReleaseSocket(handle->group_name(), socket.Pass(), handle->id()); if (!DeleteJob(handle)) pending_callbacks_.erase(handle); if (!ReachedMaxSocketsLimit() && !stalled_request_queue_.empty()) |