GitLab

With HTTP auth committed interstitials enabled, extensions were
getting notified of each auth request twice: once when LoginHandler is
first called to cancel the auth request and show a blank error page,
and again when LoginHandler is called after committing the error page
to show a login prompt on top of it.

In common operation, the second extension dispatch was a no-op,
because the request had been destroyed already by the second entry
into LoginHandler. But, there was a race ticked by long response
bodies. That is, it was possible that the second onAuthRequired event
would be dispatched to an extension before the request was
destroyed. The request was destroyed between the second dispatch and
the extension's reply. When the extension replied,the WebRequestAPI
would simply drop the reply for the now non-existent request, never
returning control to LoginHandler so that it can proceed to show the
login prompt.

The fix is to ensure that auth requests are dispatched to extensions
only once, on the first time LoginHandler is called, before the
request is cancelled.

Bug: 1034468
Change-Id: If9eb71b38dd1738a471c3dadab4093367ab0d03f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1978898Reviewed-by: Mustafa Emre Acer <meacer@chromium.org>
Commit-Queue: Emily Stark <estark@chromium.org>
Cr-Commit-Position: refs/heads/master@{#727041}