BASELINE: Update Chromium to 90.0.4430.228

Change-Id: I2d24c073cefc4842980b84cc7e9c5419c107c501
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

2 files changed, 67 insertions, 9 deletions

diff --git a/chromium/services/network/cors/cors_url_loader_factory.cc b/chromium/services/network/cors/cors_url_loader_factory.cc
index a9f5d702dc1..6e23074a0fa 100644
--- a/chromium/services/network/cors/cors_url_loader_factory.cc
+++ b/chromium/services/network/cors/cors_url_loader_factory.cc
@@ -220,7 +220,17 @@ CorsURLLoaderFactory::CorsURLLoaderFactory(
       &CorsURLLoaderFactory::DeleteIfNeeded, base::Unretained(this)));
 }
 
-CorsURLLoaderFactory::~CorsURLLoaderFactory() = default;
+CorsURLLoaderFactory::~CorsURLLoaderFactory() {
+  // Delete loaders one at a time, since deleting one loader can cause another
+  // loader waiting on it to fail synchronously, which could result in the other
+  // loader calling DestroyURLLoader().
+  while (!loaders_.empty()) {
+    // No need to call context_->LoaderDestroyed(), since this method is only
+    // called from the NetworkContext's destructor, or when there are no
+    // remaining URLLoaders.
+    loaders_.erase(loaders_.begin());
+  }
+}
 
 void CorsURLLoaderFactory::OnLoaderCreated(
     std::unique_ptr<mojom::URLLoader> loader) {
diff --git a/chromium/services/network/cors/cors_url_loader_factory_unittest.cc b/chromium/services/network/cors/cors_url_loader_factory_unittest.cc
index 13811282f5b..dd3361f8185 100644
--- a/chromium/services/network/cors/cors_url_loader_factory_unittest.cc
+++ b/chromium/services/network/cors/cors_url_loader_factory_unittest.cc
@@ -7,7 +7,9 @@
 #include "base/macros.h"
 #include "base/test/task_environment.h"
 #include "mojo/public/cpp/bindings/remote.h"
+#include "net/base/load_flags.h"
 #include "net/proxy_resolution/configured_proxy_resolution_service.h"
+#include "net/test/embedded_test_server/embedded_test_server.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
 #include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_context_builder.h"
@@ -49,6 +51,9 @@ class CorsURLLoaderFactoryTest : public testing::Test {
  protected:
   // testing::Test implementation.
   void SetUp() override {
+    test_server_.AddDefaultHandlers();
+    ASSERT_TRUE(test_server_.Start());
+
     network_service_ = NetworkService::CreateForTesting();
 
     auto context_params = mojom::NetworkContextParams::New();
@@ -68,7 +73,7 @@ class CorsURLLoaderFactoryTest : public testing::Test {
     auto factory_params = network::mojom::URLLoaderFactoryParams::New();
     factory_params->process_id = kProcessId;
     factory_params->request_initiator_origin_lock =
-        url::Origin::Create(GURL("http://localhost"));
+        url::Origin::Create(test_server_.base_url());
     auto resource_scheduler_client =
         base::MakeRefCounted<ResourceSchedulerClient>(
             kProcessId, kRouteId, &resource_scheduler_,
@@ -81,15 +86,25 @@ class CorsURLLoaderFactoryTest : public testing::Test {
   }
 
   void CreateLoaderAndStart(const ResourceRequest& request) {
+    url_loaders_.emplace_back(mojo::Remote<mojom::URLLoader>());
+    test_cors_loader_clients_.emplace_back(
+        std::make_unique<TestURLLoaderClient>());
     cors_url_loader_factory_->CreateLoaderAndStart(
-        url_loader_.BindNewPipeAndPassReceiver(), kRouteId, kRequestId,
+        url_loaders_.back().BindNewPipeAndPassReceiver(), kRouteId, kRequestId,
         mojom::kURLLoadOptionNone, request,
-        test_cors_loader_client_.CreateRemote(),
+        test_cors_loader_clients_.back()->CreateRemote(),
         net::MutableNetworkTrafficAnnotationTag(TRAFFIC_ANNOTATION_FOR_TESTS));
   }
 
   void ResetFactory() { cors_url_loader_factory_.reset(); }
 
+  net::test_server::EmbeddedTestServer* test_server() { return &test_server_; }
+
+  std::vector<std::unique_ptr<TestURLLoaderClient>>&
+  test_cors_loader_clients() {
+    return test_cors_loader_clients_;
+  }
+
  private:
   // Test environment.
   base::test::TaskEnvironment task_environment_;
@@ -99,15 +114,17 @@ class CorsURLLoaderFactoryTest : public testing::Test {
   std::unique_ptr<NetworkContext> network_context_;
   mojo::Remote<mojom::NetworkContext> network_context_remote_;
 
+  net::test_server::EmbeddedTestServer test_server_;
+
   // CorsURLLoaderFactory instance under tests.
   std::unique_ptr<mojom::URLLoaderFactory> cors_url_loader_factory_;
   mojo::Remote<mojom::URLLoaderFactory> cors_url_loader_factory_remote_;
 
-  // Holds URLLoader that CreateLoaderAndStart() creates.
-  mojo::Remote<mojom::URLLoader> url_loader_;
+  // Holds the URLLoaders that CreateLoaderAndStart() creates.
+  std::vector<mojo::Remote<mojom::URLLoader>> url_loaders_;
 
-  // TestURLLoaderClient that records callback activities.
-  TestURLLoaderClient test_cors_loader_client_;
+  // TestURLLoaderClients that record callback activities.
+  std::vector<std::unique_ptr<TestURLLoaderClient>> test_cors_loader_clients_;
 
   // Holds for allowed origin access lists.
   OriginAccessList origin_access_list_;
@@ -118,7 +135,7 @@ class CorsURLLoaderFactoryTest : public testing::Test {
 // Regression test for https://crbug.com/906305.
 TEST_F(CorsURLLoaderFactoryTest, DestructionOrder) {
   ResourceRequest request;
-  GURL url("http://localhost");
+  GURL url = test_server()->GetURL("/hung");
   request.mode = mojom::RequestMode::kNoCors;
   request.credentials_mode = mojom::CredentialsMode::kOmit;
   request.method = net::HttpRequestHeaders::kGetMethod;
@@ -141,5 +158,36 @@ TEST_F(CorsURLLoaderFactoryTest, DestructionOrder) {
   ResetFactory();
 }
 
+TEST_F(CorsURLLoaderFactoryTest, CleanupWithSharedCacheObjectInUse) {
+  // Create a loader for a response that hangs after receiving headers, and run
+  // it until headers are received.
+  ResourceRequest request;
+  GURL url = test_server()->GetURL("/hung-after-headers");
+  request.mode = mojom::RequestMode::kNoCors;
+  request.credentials_mode = mojom::CredentialsMode::kOmit;
+  request.method = net::HttpRequestHeaders::kGetMethod;
+  request.url = url;
+  request.request_initiator = url::Origin::Create(url);
+  CreateLoaderAndStart(request);
+  test_cors_loader_clients().back()->RunUntilResponseReceived();
+
+  // Read only requests will fail synchonously on destruction of the request
+  // they're waiting on if they're in the |done_headers_queue| when the other
+  // request fails. Make a large number of such requests, spin the message loop
+  // so they end up blocked on the hung request, and then destroy all loads. A
+  // large number of loaders is needed because they're stored in a set, indexed
+  // by address, so teardown order is random.
+  request.load_flags =
+      net::LOAD_ONLY_FROM_CACHE | net::LOAD_SKIP_CACHE_VALIDATION;
+  for (int i = 0; i < 10; ++i)
+    CreateLoaderAndStart(request);
+  base::RunLoop().RunUntilIdle();
+
+  // This should result in a crash if tearing down one URLLoaderFactory
+  // resulting in a another one failing causes a crash during teardown. See
+  // https://crbug.com/1209769.
+  ResetFactory();
+}
+
 }  // namespace cors
 }  // namespace network