Fix active URLRequest tracking in NetworkDelegateQt

NetworkDelegateQt maintains a set of pointers

    QSet<net::URLRequest *> m_activeRequests

Pointers are inserted in OnBeforeURLRequest, checked in
CompleteURLRequestOnIOThread, and removed in OnURLRequestDestroyed. This design
breaks however if malloc decides to reuse the address of a recently-freed
URLRequest for a new one. For example:

1. A new URLRequest is created and passed to OnBeforeURLRequest. Inside this
method a pointer is added to m_activeRequests and a task is posted to the UI
thread.

2. The URLRequest is destroyed and OnURLRequestDestroyed is called. The pointer
is removed from the set.

3. A new URLRequest is created at the same address and again passed to
OnBeforeURLRequest. The pointer is added back to the set.

4. The task from step 1 finally returns from the UI thread to the IO thread by
executing CompleteURLRequestOnIOThread. This method is supposed to invoke a
callback, but only if the original URLRequest hasn't been destroyed yet. So it
checks if the URLRequest is still in the m_activeRequests set, sees that it is,
and invokes the callback. Of course this does not work since in actuality we are
dealing with a completely different URLRequest object that just happens to live
at the same address.

Fix by changing the tracking to work per-task and not per-URLRequest. The new
URLRequestNotification class encapsulates the logic for delivering the
notification and completing the request while dealing with potential
mid-sequence URLRequest destruction.

Change-Id: I0f61df0dccb9cb2b60893cd4d8f1b4bba844a4cd
Reviewed-by: Peter Varga <pvarga@inf.u-szeged.hu>

0 files changed, 0 insertions, 0 deletions