diff options
| author | dcheng@chromium.org <dcheng@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2013-02-14 21:44:59 +0000 |
|---|---|---|
| committer | dcheng@chromium.org <dcheng@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2013-02-14 21:44:59 +0000 |
| commit | 0a04f794c875e442a7101cf50298cd54341283f0 (patch) | |
| tree | 7292fd29b71e1aef041b4e076417a7ad3c10852a /net | |
| parent | 6d384546d45002b752440cb9c5ef58efa4a6b00d (diff) | |
| download | chromium_src-0a04f794c875e442a7101cf50298cd54341283f0.zip chromium_src-0a04f794c875e442a7101cf50298cd54341283f0.tar.gz chromium_src-0a04f794c875e442a7101cf50298cd54341283f0.tar.bz2 | |
Fix dependency on scoped_ptr::reset sequencing in ProxyResolverV8Tracing
scoped_ptr<T>::reset() currently guarantees that it deletes the old
stored pointer before assigning its argument to the stored pointer.
This is unsafe, because getting the deleter may result in the
destruction of the scoped_ptr<T> itself. unique_ptr<T> addresses this by
assigning its argument to the stored pointer before deleting the old
value of the stored pointer.
Unfortunately, this breaks code that assumes that the value of the
scoped_ptr will not change during scoped_ptr::reset() before destruction
of the old value is complete.
BUG=176091
Review URL: https://codereview.chromium.org/12261020
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@182541 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'net')
| -rw-r--r-- | net/proxy/proxy_resolver_v8_tracing.cc | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/net/proxy/proxy_resolver_v8_tracing.cc b/net/proxy/proxy_resolver_v8_tracing.cc index 67d29eb..3e561d2 100644 --- a/net/proxy/proxy_resolver_v8_tracing.cc +++ b/net/proxy/proxy_resolver_v8_tracing.cc @@ -1053,10 +1053,11 @@ ProxyResolverV8Tracing::~ProxyResolverV8Tracing() { CHECK(!set_pac_script_job_); CHECK_EQ(0, num_outstanding_callbacks_); - // Join the worker thread. - // See http://crbug.com/69710. + // Join the worker thread. See http://crbug.com/69710. Note that we call + // Stop() here instead of simply clearing thread_ since there may be pending + // callbacks on the worker thread which want to dereference thread_. base::ThreadRestrictions::ScopedAllowIO allow_io; - thread_.reset(); + thread_->Stop(); } int ProxyResolverV8Tracing::GetProxyForURL(const GURL& url, |