Bug 1648132 - Do not allow setting new listener after we handle all the IPCs before SendOnStartReqeust, r=kershaw

HttpChannelChild::OnStartRequest should copy argument only since HttpChannelChild::RecvAttachStreamFilter, who sets new listener, could be after OnStartRequest.

Differential Revision: https://phabricator.services.mozilla.com/D80964

netwerk/protocol/http/HttpChannelChild.cpp

@@ -460,6 +460,8 @@ void HttpChannelChild::OnStartRequest(
     return;
   }
 
+  // Copy arguments only. It's possible to handle other IPC between
+  // OnStartRequest and DoOnStartRequest.
   mComputedCrossOriginOpenerPolicy = aArgs.openerPolicy();
 
   if (!mCanceled && NS_SUCCEEDED(mStatus)) {
@@ -514,8 +516,6 @@ void HttpChannelChild::OnStartRequest(
   //
   // gHttpHandler->OnExamineResponse(this);
 
-  mTracingEnabled = false;
-
   ResourceTimingStructArgsToTimingsStruct(aArgs.timing(), mTransactionTimings);
 
   mAllRedirectsSameOrigin = aArgs.allRedirectsSameOrigin();
@@ -658,6 +658,11 @@ void HttpChannelChild::DoOnStartRequest(nsIRequest* aRequest,
 
   LOG(("HttpChannelChild::DoOnStartRequest [this=%p]\n", this));
 
+  // We handle all the listener chaining before OnStartRequest at this moment.
+  // Prevent additional listeners being added to the chain after the request
+  // as started.
+  mTracingEnabled = false;
+
   // mListener could be null if the redirect setup is not completed.
   MOZ_ASSERT(mListener || mOnStartRequestCalled);
   if (!mListener) {