summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorjam <jam@chromium.org>2015-05-19 15:23:52 -0700
committerCommit bot <commit-bot@chromium.org>2015-05-19 22:24:38 +0000
commit05f187772cffebd3caed3936e314c7ce92ba716b (patch)
treef3e20dd77de7ed5a60cb34d56372f1c1695dd6d9
parent7dd0529036b94a81b1812ea7f98afec89528975b (diff)
downloadchromium_src-05f187772cffebd3caed3936e314c7ce92ba716b.zip
chromium_src-05f187772cffebd3caed3936e314c7ce92ba716b.tar.gz
chromium_src-05f187772cffebd3caed3936e314c7ce92ba716b.tar.bz2
Fix crash in network_service.
The problem is that |response| was passed in the Bind call before the body was taken out. I saw this because of null dereference on Windows. The order of evaluation is undefined, which is why it worked on Linux. Review URL: https://codereview.chromium.org/1138443004 Cr-Commit-Position: refs/heads/master@{#330634}
-rw-r--r--mojo/services/network/http_connection_impl.cc3
1 files changed, 2 insertions, 1 deletions
diff --git a/mojo/services/network/http_connection_impl.cc b/mojo/services/network/http_connection_impl.cc
index be306cd..0831d1d 100644
--- a/mojo/services/network/http_connection_impl.cc
+++ b/mojo/services/network/http_connection_impl.cc
@@ -141,8 +141,9 @@ void HttpConnectionImpl::OnReceivedHttpRequest(
if (response->body.is_valid()) {
SimpleDataPipeReader* reader = new SimpleDataPipeReader;
response_body_readers_.insert(reader);
+ ScopedDataPipeConsumerHandle body = response->body.Pass();
reader->Start(
- response->body.Pass(),
+ body.Pass(),
base::Bind(&HttpConnectionImpl::OnFinishedReadingResponseBody,
base::Unretained(this), base::Passed(&response)));
} else {