Merge 147914 - Remove possibility of stale user_buffer_ member in PPB_URLLoader_Impl when FinishedLoading() is called.

BUG=137778

Review URL: https://chromiumcodereview.appspot.com/10797037

TBR=tsepez@chromium.org
Review URL: https://chromiumcodereview.appspot.com/10883038

git-svn-id: svn://svn.chromium.org/chrome/branches/1180/src@153350 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 6 insertions, 0 deletions

diff --git a/webkit/plugins/ppapi/ppb_url_loader_impl.cc b/webkit/plugins/ppapi/ppb_url_loader_impl.cc
index 7e4fdef..1d2f72c 100644
--- a/webkit/plugins/ppapi/ppb_url_loader_impl.cc
+++ b/webkit/plugins/ppapi/ppb_url_loader_impl.cc
@@ -388,6 +388,8 @@ void PPB_URLLoader_Impl::SetDefersLoading(bool defers_loading) {
 
 void PPB_URLLoader_Impl::FinishLoading(int32_t done_status) {
   done_status_ = done_status;
+  user_buffer_ = NULL;
+  user_buffer_size_ = 0;
   // If the client hasn't called any function that takes a callback since
   // the initial call to Open, or called ReadResponseBody and got a
   // synchronous return, then the callback will be NULL.
@@ -423,6 +425,10 @@ void PPB_URLLoader_Impl::RunCallback(int32_t result) {
     CHECK(main_document_loader_);
     return;
   }
+
+  // If |user_buffer_| was set as part of registering the callback, ensure
+  // it got cleared since the callback is now free to delete it.
+  DCHECK(!user_buffer_);
   TrackedCallback::ClearAndRun(&pending_callback_, result);
 }