From 28140548638026b1f745591d92b20eaa9257b753 Mon Sep 17 00:00:00 2001 From: Marshall Greenblatt Date: Wed, 29 May 2019 09:41:05 -0700 Subject: [PATCH] Linux: Fix crash when closing a browser with pending requests (see issue #2622). This change fixes an issue where the cancel_callback for a pending request might already have been executed when the OnBrowserDestroyed notification is received. --- .../resource_request_handler_wrapper.cc | 24 ++++++++++++++----- 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/libcef/browser/net_service/resource_request_handler_wrapper.cc b/libcef/browser/net_service/resource_request_handler_wrapper.cc index 1587ec978..d71a65cbd 100644 --- a/libcef/browser/net_service/resource_request_handler_wrapper.cc +++ b/libcef/browser/net_service/resource_request_handler_wrapper.cc @@ -479,7 +479,9 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler { if (!allow) { // Cancel the request. - std::move(state->cancel_callback_).Run(net::ERR_ABORTED); + if (state->cancel_callback_) { + std::move(state->cancel_callback_).Run(net::ERR_ABORTED); + } return; } @@ -748,7 +750,9 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler { return; } - std::move(state->cancel_callback_).Run(net::ERR_CONTENT_DECODING_FAILED); + if (state->cancel_callback_) { + std::move(state->cancel_callback_).Run(net::ERR_CONTENT_DECODING_FAILED); + } } void OnRequestComplete( @@ -758,7 +762,10 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler { CEF_REQUIRE_IOT(); RequestState* state = GetState(id); - DCHECK(state); + if (!state) { + // The request may have been canceled. + return; + } // Redirection of standard custom schemes is handled with a restart, so we // get completion notifications for both the original (redirected) request @@ -889,9 +896,14 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler { // Cancel any pending requests. while (!request_map_.empty()) { - // Results in a call to RemoveState(). - std::move(request_map_.begin()->second->cancel_callback_) - .Run(net::ERR_ABORTED); + auto cancel_callback = + std::move(request_map_.begin()->second->cancel_callback_); + if (cancel_callback) { + // Results in a call to RemoveState(). + std::move(cancel_callback).Run(net::ERR_ABORTED); + } else { + RemoveState(request_map_.begin()->first); + } } }