Fix for bug 3347616, crash when closing browser with requests in flight

The problem is if a request is just started as the browser (or a tab)
is closed. That can give delete the scoped_refptr before the
refcount is increased on the IO thread.

Refcounted objects should not be passed as raw pointers between
threads.

Change-Id: I57a9b30f5fdfef3c6d45b81ea59a61f96b09e6ae

1 files changed, 7 insertions, 3 deletions

diff --git a/WebKit/android/WebCoreSupport/WebRequest.cpp b/WebKit/android/WebCoreSupport/WebRequest.cpp
index da84126..9e464c1 100644
--- a/WebKit/android/WebCoreSupport/WebRequest.cpp
+++ b/WebKit/android/WebCoreSupport/WebRequest.cpp
@@ -152,7 +152,13 @@ void WebRequest::appendBytesToUpload(WTF::Vector<char>* data)
     delete data;
 }
 
-void WebRequest::start(WebRequestContext* context)
+void WebRequest::setRequestContext(WebRequestContext* context)
+{
+    if (m_request)
+        m_request->set_context(context);
+}
+
+void WebRequest::start()
 {
     ASSERT(m_loadState == Created, "Start called on a WebRequest not in CREATED state: (%s)", m_url.c_str());
 
@@ -168,8 +174,6 @@ void WebRequest::start(WebRequestContext* context)
     if (m_request->url().SchemeIs("browser"))
         return handleBrowserURL(m_request->url());
 
-    m_request->set_context(context);
-
     m_request->Start();
 }