From c54630d880fcdfcf174b25f57619d94eccaca87e Mon Sep 17 00:00:00 2001
From: cobalt-github-releaser-bot
 <95661244+cobalt-github-releaser-bot@users.noreply.github.com>
Date: Wed, 28 Jun 2023 17:00:37 -0700
Subject: [PATCH] Fix crash in net fetcher (#713) (#784)

Crash could occur because of concurrent execution of GetLoadTiminInfo and Stop.
The problem solved by let the content of the GetLoadTimingInfo function
(i.e. ReportLoadTimingInfo) be executed by the delegate thread.

b/266121186

Change-Id: I5249ed823c3cf9ff230e18cfa660a42347c9da99
(cherry picked from commit d0e16892e09ddb442d19b84c98063c656d41ee13)

Co-authored-by: MichaelSweden <MichaelSweden@users.noreply.github.com>
---
 net/url_request/url_fetcher_core.cc | 14 +++++++++++++-
 net/url_request/url_fetcher_core.h  |  1 +
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/net/url_request/url_fetcher_core.cc b/net/url_request/url_fetcher_core.cc
index 6cdcfec75fe5..2db08cca0beb 100644
--- a/net/url_request/url_fetcher_core.cc
+++ b/net/url_request/url_fetcher_core.cc
@@ -175,8 +175,9 @@ void URLFetcherCore::Start() {
 }
 
 void URLFetcherCore::Stop() {
-  if (delegate_task_runner_)  // May be NULL in tests.
+  if (delegate_task_runner_) {  // May be NULL in tests.
     DCHECK(delegate_task_runner_->RunsTasksInCurrentSequence());
+  }
 
   delegate_ = NULL;
   fetcher_ = NULL;
@@ -779,8 +780,11 @@ void URLFetcherCore::StartURLRequest() {
   if (!extra_request_headers_.IsEmpty())
     request_->SetExtraRequestHeaders(extra_request_headers_);
 
+#if defined(STARBOARD)
   request_->SetLoadTimingInfoCallback(base::Bind(&URLFetcherCore::GetLoadTimingInfo,
       base::Unretained(this)));
+#endif
+
   request_->Start();
 }
 
@@ -1129,6 +1133,14 @@ void URLFetcherCore::AssertHasNoUploadData() const {
 #if defined(STARBOARD)
 void URLFetcherCore::GetLoadTimingInfo(
     const net::LoadTimingInfo& timing_info) {
+  delegate_task_runner_->PostTask(
+      FROM_HERE,
+      base::Bind(&URLFetcherCore::GetLoadTimingInfoInDelegateThread,
+                 this, timing_info));
+}
+
+void URLFetcherCore::GetLoadTimingInfoInDelegateThread(
+    const net::LoadTimingInfo& timing_info) {
   // Check if the URLFetcherCore has been stopped before.
   if (delegate_) {
     delegate_->ReportLoadTimingInfo(timing_info);
diff --git a/net/url_request/url_fetcher_core.h b/net/url_request/url_fetcher_core.h
index 4359ac549569..a06f82f72115 100644
--- a/net/url_request/url_fetcher_core.h
+++ b/net/url_request/url_fetcher_core.h
@@ -164,6 +164,7 @@ class URLFetcherCore : public base::RefCountedThreadSafe<URLFetcherCore>,
   static void SetIgnoreCertificateRequests(bool ignored);
 #if defined (STARBOARD)
   void GetLoadTimingInfo(const net::LoadTimingInfo& timing_info);
+  void GetLoadTimingInfoInDelegateThread(const net::LoadTimingInfo& timing_info);
 #endif  // defined(STARBOARD)
  private:
   friend class base::RefCountedThreadSafe<URLFetcherCore>;