Fix race condition

Author: mrdimidium

src/browser/HttpClient.zig

@@ -747,7 +747,7 @@ fn processOneMessage(self: *Client, msg: Network.Handle.Completion, transfer: *T
     if (body.len > 0) {
         try transfer.req.data_callback(Response.fromTransfer(transfer), body);
 
-        if (transfer.aborted) {
+        if (transfer.isAborted()) {
             transfer.requestFailed(error.Abort, true);
             return true;
         }
@@ -1029,7 +1029,7 @@ pub const Transfer = struct {
     client: *Client,
 
     start_time: u64,
-    aborted: bool = false,
+    aborted: std.atomic.Value(bool) = .init(false),
 
     _notified_fail: bool = false,
 
@@ -1083,6 +1083,14 @@ pub const Transfer = struct {
         arena_pool.release(arena);
     }
 
+    pub fn isAborted(self: *const Transfer) bool {
+        return self.aborted.load(.acquire);
+    }
+
+    fn setAborted(self: *Transfer) void {
+        self.aborted.store(true, .release);
+    }
+
     // Cancel this transfer with `err`. Fires error_callback once (latched
     // via _notified_fail), then either deinits synchronously or, if we're
     // mid-perform with a libcurl handle still in the multi, detaches and
@@ -1123,7 +1131,7 @@ pub const Transfer = struct {
     // there is nothing left referencing this transfer and we can safely
     // deinit inline even from inside a perform callback.
     fn detachOrDeinit(self: *Transfer) void {
-        if (self.aborted) return;
+        if (self.isAborted()) return;
         if (self._performing) {
             self.detachInPerform();
         } else if (self._conn) |conn| {
@@ -1147,7 +1155,7 @@ pub const Transfer = struct {
     //     `owner == null` and skips the list-remove that would otherwise
     //     UAF against a freed list.
     fn detachInPerform(self: *Transfer) void {
-        self.aborted = true;
+        self.setAborted();
         self.req.start_callback = null;
         self.req.shutdown_callback = null;
         self.req.header_callback = Noop.headerCallback;
@@ -1425,7 +1433,7 @@ pub const Transfer = struct {
             return err;
         };
 
-        return proceed and transfer.aborted == false;
+        return proceed and !transfer.isAborted();
     }
 
     fn dataCallback(buffer: [*]const u8, chunk_count: usize, chunk_len: usize, data: *anyopaque) usize {
@@ -1475,7 +1483,7 @@ pub const Transfer = struct {
             return http.writefunc_error;
         };
 
-        if (transfer.aborted) {
+        if (transfer.isAborted()) {
             return http.writefunc_error;
         }
 

src/browser/Runner.zig

@@ -212,18 +212,10 @@ fn _tick(self: *Runner, comptime is_cdp: bool, opts: TickOpts) !CDPTickResult {
                 },
             }
 
-            if (http_active == 0 and http_client.handle.ws_active == 0 and http_client.queue.first == null and http_client.handle.ready_queue.first == null and (comptime is_cdp == false)) {
+            if (http_active == 0 and http_client.handle.ws_active == 0 and http_client.queue.first == null and (comptime is_cdp == false)) {
                 // we don't need to consider http_client.intercepted here
                 // because is_cdp is false, and that can only be
                 // the case when interception isn't possible.
-                //
-                // ready_queue is also part of the check: makeRequest now
-                // wraps its handles.perform() in a performing=true window,
-                // and any synchronous libcurl callback that ends up
-                // calling trackConn during that window (e.g. JS creating
-                // a WebSocket) will append to ready_queue. Without this
-                // check we could observe it non-empty after
-                // http_client.tick returns.
                 if (comptime IS_DEBUG) {
                     std.debug.assert(http_client.interception_layer.intercepted == 0);
                 }

src/browser/ScriptManagerBase.zig

@@ -576,7 +576,7 @@ pub const Script = struct {
                     .a9 = self.debug_transfer_easy_id,
                     .b1 = transfer.id,
                     .b2 = transfer._tries,
-                    .b3 = transfer.aborted,
+                    .b3 = transfer.isAborted(),
                     .b4 = transfer.res.bytes_received,
                     .b5 = transfer._notified_fail,
                     .b8 = transfer._auth_challenge != null,
@@ -585,7 +585,7 @@ pub const Script = struct {
                 self.header_callback_called = true;
                 self.debug_transfer_id = transfer.id;
                 self.debug_transfer_tries = transfer._tries;
-                self.debug_transfer_aborted = transfer.aborted;
+                self.debug_transfer_aborted = transfer.isAborted();
                 self.debug_transfer_bytes_received = transfer.res.bytes_received;
                 self.debug_transfer_notified_fail = transfer._notified_fail;
                 self.debug_transfer_auth_challenge = transfer._auth_challenge != null;