Fix 33631 - crash when 304 is received but there's no entry in the cache.

netwerk/protocol/http/src/nsHTTPChannel.cpp

@@ -1346,48 +1346,48 @@ nsresult nsHTTPChannel::ResponseCompleted(nsIStreamListener *aListener,
                                           nsresult aStatus,
                                           const PRUnichar* aMsg)
 {
-  nsresult rv = NS_OK;
+    nsresult rv = NS_OK;
 
-  //
-  // First:
-  //
-  // Call the consumer OnStopRequest(...) to end the request...
-  if (aListener) {
-    rv = aListener->OnStopRequest(this, mResponseContext, aStatus, aMsg);
+    //
+    // First:
+    //
+    // Call the consumer OnStopRequest(...) to end the request...
+    if (aListener)
+    {
+        rv = aListener -> OnStopRequest (this, mResponseContext, aStatus, aMsg);
 
-    if (NS_FAILED(rv)) {
-      PR_LOG(gHTTPLog, PR_LOG_ERROR, 
-             ("nsHTTPChannel::OnStopRequest(...) [this=%x]."
-              "\tOnStopRequest to consumer failed! Status:%x\n",
-              this, rv));
+        if (NS_FAILED (rv))
+        {
+            PR_LOG(gHTTPLog, PR_LOG_ERROR, ("nsHTTPChannel::OnStopRequest(...) [this=%x]."
+                "\tOnStopRequest to consumer failed! Status:%x\n",
+                this, rv));
+        }
     }
-  }
 
-  //
-  // After the consumer has been notified, remove the channel from its 
-  // load group...  This will trigger an OnStopRequest from the load group.
-  //
-  if (mLoadGroup) {
-    (void)mLoadGroup->RemoveChannel(this, nsnull, aStatus, nsnull);
-  }
+    //
+    // After the consumer has been notified, remove the channel from its 
+    // load group...  This will trigger an OnStopRequest from the load group.
+    //
     
-  //
-  // Finally, notify the OpenObserver that the request has completed.
-  //
-  if (mOpenObserver) {
-      (void) mOpenObserver->OnStopRequest(this, mOpenContext, aStatus, aMsg);
-  }
+    if (mLoadGroup)
+        mLoadGroup -> RemoveChannel (this, nsnull, aStatus, nsnull);
 
-  // Null out pointers that are no longer needed...
+    //
+    // Finally, notify the OpenObserver that the request has completed.
+    //
+    if (mOpenObserver)
+        mOpenObserver -> OnStopRequest (this, mOpenContext, aStatus, aMsg);
 
-// rjc says: don't null out mResponseContext;
-// it needs to be valid for the life of the channel
-//  mResponseContext = 0;
+    // Null out pointers that are no longer needed...
 
-  mResponseDataListener = 0;
-  NS_IF_RELEASE(mCachedResponse);
+    // rjc says: don't null out mResponseContext;
+    // it needs to be valid for the life of the channel
+    //  mResponseContext = 0;
 
-  return rv;
+    mResponseDataListener = 0;
+    NS_IF_RELEASE (mCachedResponse);
+
+    return rv;
 }
 
 nsresult nsHTTPChannel::SetResponse(nsHTTPResponse* i_pResp)
@@ -1775,8 +1775,12 @@ nsHTTPChannel::ProcessStatusCode(void)
 }
 
 nsresult
-nsHTTPChannel::ProcessNotModifiedResponse(nsIStreamListener *aListener)
+nsHTTPChannel::ProcessNotModifiedResponse (nsIStreamListener *aListener)
 {
+    // if there is no cached entry - bail right away
+    if (!mCachedResponse)
+        return NS_OK;
+
     nsresult rv;
     NS_ASSERTION(!mCachedContentIsValid, 
             "We should never have cached a 304 response");

netwerk/protocol/http/src/nsHTTPChannel.h

@@ -127,6 +127,7 @@ public:
     nsHTTPRequest*                      mRequest;
     nsHTTPResponseListener*             mHTTPServerListener;
     nsCOMPtr<nsISupports>               mResponseContext;
+    nsHTTPResponse*                     mCachedResponse;
 
 protected:
     nsCOMPtr<nsIURI>                    mOriginalURI;
@@ -150,7 +151,6 @@ protected:
     
     // Cache-related members
     nsCOMPtr<nsICachedNetData>          mCacheEntry;
-    nsHTTPResponse*                     mCachedResponse;
     PRBool                              mCachedContentIsAvailable;
     PRBool                              mCachedContentIsValid;
     

netwerk/protocol/http/src/nsHTTPResponseListener.cpp

@@ -485,23 +485,19 @@ nsHTTPServerListener::OnStopRequest(nsIChannel* channel,
 
     // Notify the HTTPChannel that the response has completed...
     NS_ASSERTION(mChannel, "HTTPChannel is null.");
-    if (mChannel) {
+    if (mChannel)
+    {
         PRUint32 status = 0;
 
-        if (mResponse) {
+        if (mResponse)
             mResponse->GetStatus(&status);
+
+        if (!mChannel -> mCachedResponse)
+        {
+            mChannel -> ResponseCompleted (mResponseDataListener, i_Status, i_pMsg);
+            mChannel -> mHTTPServerListener = 0;
         }
 
-        if (status != 304) {
-            mChannel->ResponseCompleted(mResponseDataListener, 
-                                        i_Status, i_pMsg);
-            // The HTTPChannel no longer needs a reference to this object.
-            mChannel->mHTTPServerListener = 0;
-        } else {
-            PR_LOG(gHTTPLog, PR_LOG_DEBUG,
-                  ("nsHTTPServerListener::OnStopRequest [this=%x]. "
-                   "Discarding 304 response\n", this));
-        }
         PRBool keepAlive = PR_FALSE;
 
         if (mResponse)