Commit 42e6c125 authored by valenting's avatar valenting
Browse files

Bug 1870499 - Break potential runnable loop in HttpChannelChild::Release a=diannaS 

Original Revision: https://phabricator.services.mozilla.com/D202797

Differential Revision: https://phabricator.services.mozilla.com/D204062
parent e8e445bf

netwerk/protocol/http/HttpChannelChild.cpp

+7 −2
Original line number Diff line number Diff line
@@ -87,7 +87,8 @@ HttpChannelChild::HttpChannelChild() 
      mIsLastPartOfMultiPart(false),

      mSuspendForWaitCompleteRedirectSetup(false),

      mRecvOnStartRequestSentCalled(false),

      mSuspendedByWaitingForPermissionCookie(false) {

      mSuspendedByWaitingForPermissionCookie(false),

      mAlreadyReleased(false) {

  LOG(("Creating HttpChannelChild @%p\n", this));



  mChannelCreationTime = PR_Now();
@@ -199,12 +200,16 @@ NS_IMETHODIMP_(MozExternalRefCountType) HttpChannelChild::Release() { 
    // We don't have a listener when AsyncOpen has failed or when this channel

    // has been sucessfully redirected.

    if (MOZ_LIKELY(LoadOnStartRequestCalled() && LoadOnStopRequestCalled()) ||

        !mListener) {

        !mListener || mAlreadyReleased) {

      NS_LOG_RELEASE(this, 0, "HttpChannelChild");

      delete this;

      return 0;

    }



    // This ensures that when the refcount goes to 0 again, we don't dispatch

    // yet another runnable and get in a loop.

    mAlreadyReleased = true;



    // This makes sure we fulfill the stream listener contract all the time.

    if (NS_SUCCEEDED(mStatus)) {

      mStatus = NS_ERROR_ABORT;

netwerk/protocol/http/HttpChannelChild.h

+6 −0
Original line number Diff line number Diff line
@@ -395,6 +395,12 @@ class HttpChannelChild final : public PHttpChannelChild, 
  // permission or cookie. That is, RecvOnStartRequestSent is received.

  uint8_t mSuspendedByWaitingForPermissionCookie : 1;



  // HttpChannelChild::Release has some special logic that makes sure

  // OnStart/OnStop are always called when releasing the channel.

  // But we have to make sure we only do this once - otherwise we could

  // get stuck in a loop.

  uint8_t mAlreadyReleased : 1;



  void CleanupRedirectingChannel(nsresult rv);



  // Calls OnStartRequest and/or OnStopRequest on our listener in case we didn't