Bug 904571 - crash in mozilla::net::HttpChannelParentListener::OnRedirectResult, r=jduell

This commit is contained in:
Honza Bambas 2014-03-05 15:01:54 +01:00
parent 35ac903785
commit bc19c36809
3 changed files with 22 additions and 4 deletions

View File

@ -195,7 +195,11 @@ HttpChannelParentListener::OnRedirectResult(bool succeeded)
"Channel finished a redirect response, but doesn't implement "
"nsIParentRedirectingChannel to complete it.");
activeRedirectingChannel->CompleteRedirect(succeeded);
if (activeRedirectingChannel) {
activeRedirectingChannel->CompleteRedirect(succeeded);
} else {
succeeded = false;
}
if (succeeded) {
// Switch to redirect channel and delete the old one.

View File

@ -147,7 +147,16 @@ WillRedirect(const nsHttpResponseHead * response)
class AutoRedirectVetoNotifier
{
public:
AutoRedirectVetoNotifier(nsHttpChannel* channel) : mChannel(channel) {}
AutoRedirectVetoNotifier(nsHttpChannel* channel) : mChannel(channel)
{
if (mChannel->mHasAutoRedirectVetoNotifier) {
MOZ_CRASH("Nested AutoRedirectVetoNotifier on the stack");
mChannel = nullptr;
return;
}
mChannel->mHasAutoRedirectVetoNotifier = true;
}
~AutoRedirectVetoNotifier() {ReportRedirectResult(false);}
void RedirectSucceeded() {ReportRedirectResult(true);}
@ -169,13 +178,15 @@ AutoRedirectVetoNotifier::ReportRedirectResult(bool succeeded)
NS_GET_IID(nsIRedirectResultListener),
getter_AddRefs(vetoHook));
#ifdef MOZ_VISUAL_EVENT_TRACER
nsHttpChannel* channel = mChannel;
#endif
mChannel = nullptr;
if (vetoHook)
vetoHook->OnRedirectResult(succeeded);
// Drop after the notification
channel->mHasAutoRedirectVetoNotifier = false;
MOZ_EVENT_TRACER_DONE(channel, "net::http::redirect-callbacks");
}
@ -207,6 +218,7 @@ nsHttpChannel::nsHttpChannel()
, mHasQueryString(0)
, mConcurentCacheAccess(0)
, mIsPartialRequest(0)
, mHasAutoRedirectVetoNotifier(0)
, mDidReval(false)
{
LOG(("Creating nsHttpChannel [this=%p]\n", this));

View File

@ -395,6 +395,8 @@ private:
uint32_t mConcurentCacheAccess : 1;
// whether the request is setup be byte-range
uint32_t mIsPartialRequest : 1;
// true iff there is AutoRedirectVetoNotifier on the stack
uint32_t mHasAutoRedirectVetoNotifier : 1;
nsTArray<nsContinueRedirectionFunc> mRedirectFuncStack;