Bug 904571 - crash in mozilla::net::HttpChannelParentListener::OnRedirectResult, r=jduell

netwerk/protocol/http/HttpChannelParentListener.cpp

@@ -195,7 +195,11 @@ HttpChannelParentListener::OnRedirectResult(bool succeeded)
     "Channel finished a redirect response, but doesn't implement "
     "nsIParentRedirectingChannel to complete it.");
 
-  activeRedirectingChannel->CompleteRedirect(succeeded);
+  if (activeRedirectingChannel) {
+    activeRedirectingChannel->CompleteRedirect(succeeded);
+  } else {
+    succeeded = false;
+  }
 
   if (succeeded) {
     // Switch to redirect channel and delete the old one.

netwerk/protocol/http/nsHttpChannel.cpp

@@ -147,7 +147,16 @@ WillRedirect(const nsHttpResponseHead * response)
 class AutoRedirectVetoNotifier
 {
 public:
-    AutoRedirectVetoNotifier(nsHttpChannel* channel) : mChannel(channel) {}
+    AutoRedirectVetoNotifier(nsHttpChannel* channel) : mChannel(channel)
+    {
+      if (mChannel->mHasAutoRedirectVetoNotifier) {
+        MOZ_CRASH("Nested AutoRedirectVetoNotifier on the stack");
+        mChannel = nullptr;
+        return;
+      }
+
+      mChannel->mHasAutoRedirectVetoNotifier = true;
+    }
     ~AutoRedirectVetoNotifier() {ReportRedirectResult(false);}
     void RedirectSucceeded() {ReportRedirectResult(true);}
 
@@ -169,13 +178,15 @@ AutoRedirectVetoNotifier::ReportRedirectResult(bool succeeded)
                                   NS_GET_IID(nsIRedirectResultListener),
                                   getter_AddRefs(vetoHook));
 
-#ifdef MOZ_VISUAL_EVENT_TRACER
     nsHttpChannel* channel = mChannel;
-#endif
     mChannel = nullptr;
+
     if (vetoHook)
         vetoHook->OnRedirectResult(succeeded);
 
+    // Drop after the notification
+    channel->mHasAutoRedirectVetoNotifier = false;
+
     MOZ_EVENT_TRACER_DONE(channel, "net::http::redirect-callbacks");
 }
 
@@ -207,6 +218,7 @@ nsHttpChannel::nsHttpChannel()
     , mHasQueryString(0)
     , mConcurentCacheAccess(0)
     , mIsPartialRequest(0)
+    , mHasAutoRedirectVetoNotifier(0)
     , mDidReval(false)
 {
     LOG(("Creating nsHttpChannel [this=%p]\n", this));

netwerk/protocol/http/nsHttpChannel.h

@@ -395,6 +395,8 @@ private:
     uint32_t                          mConcurentCacheAccess : 1;
     // whether the request is setup be byte-range
     uint32_t                          mIsPartialRequest : 1;
+    // true iff there is AutoRedirectVetoNotifier on the stack
+    uint32_t                          mHasAutoRedirectVetoNotifier : 1;
 
     nsTArray<nsContinueRedirectionFunc> mRedirectFuncStack;