diff options
| author | eroman@chromium.org <eroman@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2009-09-18 21:09:26 +0000 |
|---|---|---|
| committer | eroman@chromium.org <eroman@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2009-09-18 21:09:26 +0000 |
| commit | 1877a22169d10e18287d334f0259ac96d3ab1a52 (patch) | |
| tree | 2a1645f329a44aefe614c08d2eb3e8c17e38ee16 /net | |
| parent | 42b6f0f83579563a94bd9fdeec83574a1a932f18 (diff) | |
| download | chromium_src-1877a22169d10e18287d334f0259ac96d3ab1a52.zip chromium_src-1877a22169d10e18287d334f0259ac96d3ab1a52.tar.gz chromium_src-1877a22169d10e18287d334f0259ac96d3ab1a52.tar.bz2 | |
Make sure that the LoadLog does not get freed on the worker thread during request cancellation.
BUG=22272
TEST=must pass existing tests when running with TSAN.
Review URL: http://codereview.chromium.org/214025
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@26610 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'net')
| -rw-r--r-- | net/base/host_resolver_impl.cc | 13 |
1 files changed, 8 insertions, 5 deletions
diff --git a/net/base/host_resolver_impl.cc b/net/base/host_resolver_impl.cc index 61f075e..c93c8eb 100644 --- a/net/base/host_resolver_impl.cc +++ b/net/base/host_resolver_impl.cc @@ -73,6 +73,9 @@ class HostResolverImpl::Request { job_ = NULL; callback_ = NULL; addresses_ = NULL; + // Clear the LoadLog to make sure it won't be released later on the + // worker thread. See http://crbug.com/22272 + load_log_ = NULL; } bool was_cancelled() const { @@ -187,10 +190,8 @@ class HostResolverImpl::Job origin_loop_ = NULL; } - // We don't have to do anything further to actually cancel the requests - // that were attached to this job (since they are unreachable now). - // But we will call HostResolverImpl::CancelRequest(Request*) on each one - // in order to notify any observers. + // We will call HostResolverImpl::CancelRequest(Request*) on each one + // in order to notify any observers, and also clear the LoadLog. for (RequestsList::const_iterator it = requests_.begin(); it != requests_.end(); ++it) { HostResolverImpl::Request* req = *it; @@ -395,9 +396,11 @@ void HostResolverImpl::CancelRequest(RequestHandle req_handle) { Request* req = reinterpret_cast<Request*>(req_handle); DCHECK(req); DCHECK(req->job()); + // Hold a reference to the request's load log as we are about to clear it. + scoped_refptr<LoadLog> load_log(req->load_log()); // NULL out the fields of req, to mark it as cancelled. req->MarkAsCancelled(); - OnCancelRequest(req->load_log(), req->id(), req->info()); + OnCancelRequest(load_log, req->id(), req->info()); } void HostResolverImpl::AddObserver(Observer* observer) { |