Change URLRequest to use a ref-counted buffer for actual IO.The ref-counting will prevent the deletion / reuse of memorywhile the buffer is actually being used by pending IO.This seems a very intrusive change, but at least we will be ableto make sure that it works without having to chase every singledestruction of an URLRequest to make sure that any pending IOwas cancelled, and also allows us to avoid blocking onthe object destruction.BUG=5325

Review URL: http://codereview.chromium.org/18390

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@8603 0039d316-1c4b-4281-b951-d872f2087c98

5 files changed, 19 insertions, 10 deletions

diff --git a/chrome/browser/download/download_file.cc b/chrome/browser/download/download_file.cc
index 70d733d..5d7b5e5c 100644
--- a/chrome/browser/download/download_file.cc
+++ b/chrome/browser/download/download_file.cc
@@ -23,6 +23,7 @@
 #include "chrome/common/win_util.h"
 #include "chrome/common/win_safe_util.h"
 #include "googleurl/src/gurl.h"
+#include "net/base/io_buffer.h"
 #include "net/base/net_util.h"
 #include "net/url_request/url_request_context.h"
 
@@ -265,11 +266,11 @@ void DownloadFileManager::UpdateDownload(int id, DownloadBuffer* buffer) {
 
   DownloadFile* download = LookupDownload(id);
   for (size_t i = 0; i < contents.size(); ++i) {
-    char* data = contents[i].first;
+    net::IOBuffer* data = contents[i].first;
     const int data_len = contents[i].second;
     if (download)
-      download->AppendDataToFile(data, data_len);
-    delete [] data;
+      download->AppendDataToFile(data->data(), data_len);
+    data->Release();
   }
 
   if (download) {
diff --git a/chrome/browser/download/download_file.h b/chrome/browser/download/download_file.h
index ea74318..f1ffcea 100644
--- a/chrome/browser/download/download_file.h
+++ b/chrome/browser/download/download_file.h
@@ -52,6 +52,9 @@
 #include "base/timer.h"
 #include "chrome/browser/history/download_types.h"
 
+namespace net {
+class IOBuffer;
+}
 class DownloadManager;
 class FilePath;
 class GURL;
@@ -70,7 +73,7 @@ class URLRequestContext;
 
 struct DownloadBuffer {
   Lock lock;
-  typedef std::pair<char *, int> Contents;
+  typedef std::pair<net::IOBuffer*, int> Contents;
   std::vector<Contents> contents;
 };
 
diff --git a/chrome/browser/download/save_file_manager.cc b/chrome/browser/download/save_file_manager.cc
index fbf5782..64984de 100644
--- a/chrome/browser/download/save_file_manager.cc
+++ b/chrome/browser/download/save_file_manager.cc
@@ -25,6 +25,7 @@
 #include "chrome/common/win_safe_util.h"
 #include "googleurl/src/gurl.h"
 #include "net/base/net_util.h"
+#include "net/base/io_buffer.h"
 #include "net/url_request/url_request_context.h"
 
 SaveFileManager::SaveFileManager(MessageLoop* ui_loop,
@@ -271,12 +272,12 @@ void SaveFileManager::StartSave(SaveFileCreateInfo* info) {
 // thread). We may receive a few more updates before the IO thread gets the
 // cancel message. We just delete the data since the SaveFile has been deleted.
 void SaveFileManager::UpdateSaveProgress(int save_id,
-                                         char* data,
+                                         net::IOBuffer* data,
                                          int data_len) {
   DCHECK(MessageLoop::current() == GetSaveLoop());
   SaveFile* save_file = LookupSaveFile(save_id);
   if (save_file) {
-    bool write_success = save_file->AppendDataToFile(data, data_len);
+    bool write_success = save_file->AppendDataToFile(data->data(), data_len);
     ui_loop_->PostTask(FROM_HERE,
         NewRunnableMethod(this,
                           &SaveFileManager::OnUpdateSaveProgress,
@@ -284,7 +285,7 @@ void SaveFileManager::UpdateSaveProgress(int save_id,
                           save_file->bytes_so_far(),
                           write_success));
   }
-  delete [] data;
+  data->Release();
 }
 
 // The IO thread will call this when saving is completed or it got error when
diff --git a/chrome/browser/download/save_file_manager.h b/chrome/browser/download/save_file_manager.h
index 8bd6e89..cf29e1c 100644
--- a/chrome/browser/download/save_file_manager.h
+++ b/chrome/browser/download/save_file_manager.h
@@ -66,6 +66,9 @@
 #include "base/thread.h"
 #include "chrome/browser/download/save_types.h"
 
+namespace net {
+class IOBuffer;
+}
 class GURL;
 class SaveFile;
 class SavePackage;
@@ -101,7 +104,7 @@ class SaveFileManager
 
   // Notifications sent from the IO thread and run on the file thread:
   void StartSave(SaveFileCreateInfo* info);
-  void UpdateSaveProgress(int save_id, char* data, int size);
+  void UpdateSaveProgress(int save_id, net::IOBuffer* data, int size);
   void SaveFinished(int save_id, std::wstring save_url,
                     int render_process_id, bool is_success);
 
diff --git a/chrome/browser/download/save_package.cc b/chrome/browser/download/save_package.cc
index 1127017..1eea9e5 100644
--- a/chrome/browser/download/save_package.cc
+++ b/chrome/browser/download/save_package.cc
@@ -31,6 +31,7 @@
 #include "chrome/common/pref_service.h"
 #include "chrome/common/stl_util-inl.h"
 #include "chrome/common/win_util.h"
+#include "net/base/io_buffer.h"
 #include "net/base/mime_util.h"
 #include "net/base/net_util.h"
 #include "net/url_request/url_request_context.h"
@@ -812,8 +813,8 @@ void SavePackage::OnReceivedSerializedHtmlData(const GURL& frame_url,
 
   if (!data.empty()) {
     // Prepare buffer for saving HTML data.
-    char* new_data = static_cast<char*>(new char[data.size()]);
-    memcpy(new_data, data.data(), data.size());
+    net::IOBuffer* new_data = new net::IOBuffer(data.size());
+    memcpy(new_data->data(), data.data(), data.size());
 
     // Call write file functionality in file thread.
     file_manager_->GetSaveLoop()->PostTask(FROM_HERE,