Change URLRequest to use a ref-counted buffer for actual IO.The ref-counting will prevent the deletion / reuse of memorywhile the buffer is actually being used by pending IO.This seems a very intrusive change, but at least we will be ableto make sure that it works without having to chase every singledestruction of an URLRequest to make sure that any pending IOwas cancelled, and also allows us to avoid blocking onthe object destruction.BUG=5325

Review URL: http://codereview.chromium.org/18390

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@8603 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 11 insertions, 8 deletions

diff --git a/chrome/browser/plugin_process_host.cc b/chrome/browser/plugin_process_host.cc
index 7c272a5..aeff2d0 100644
--- a/chrome/browser/plugin_process_host.cc
+++ b/chrome/browser/plugin_process_host.cc
@@ -36,6 +36,7 @@
 #include "chrome/common/render_messages.h"
 #include "chrome/common/win_util.h"
 #include "net/base/cookie_monster.h"
+#include "net/base/io_buffer.h"
 #include "net/proxy/proxy_service.h"
 #include "net/url_request/url_request.h"
 #include "sandbox/src/sandbox.h"
@@ -127,7 +128,7 @@ class PluginDownloadUrlHelper : public URLRequest::Delegate {
   // The full path of the downloaded file.
   std::wstring download_file_path_;
   // The buffer passed off to URLRequest::Read.
-  char download_file_buffer_[kDownloadFileBufferSize];
+  scoped_refptr<net::IOBuffer> download_file_buffer_;
   // The window handle for sending the WM_COPYDATA notification,
   // indicating that the download completed.
   HWND download_file_caller_window_;
@@ -142,12 +143,13 @@ PluginDownloadUrlHelper::PluginDownloadUrlHelper(
     const std::string& download_url,
     int source_pid, HWND caller_window)
     : download_url_(download_url),
-      download_file_caller_window_(caller_window),
-      download_source_pid_(source_pid),
       download_file_request_(NULL),
-      download_file_(INVALID_HANDLE_VALUE) {
+      download_file_(INVALID_HANDLE_VALUE),
+      download_file_buffer_(new net::IOBuffer(kDownloadFileBufferSize)),
+      download_file_caller_window_(caller_window),
+      download_source_pid_(source_pid) {
   DCHECK(::IsWindow(caller_window));
-  memset(download_file_buffer_, 0, arraysize(download_file_buffer_));
+  memset(download_file_buffer_->data(), 0, kDownloadFileBufferSize);
 }
 
 PluginDownloadUrlHelper::~PluginDownloadUrlHelper() {
@@ -210,7 +212,7 @@ void PluginDownloadUrlHelper::OnResponseStarted(URLRequest* request) {
   } else {
     // Initiate a read.
     int bytes_read = 0;
-    if (!request->Read(download_file_buffer_, arraysize(download_file_buffer_),
+    if (!request->Read(download_file_buffer_, kDownloadFileBufferSize,
                        &bytes_read)) {
       // If the error is not an IO pending, then we're done
       // reading.
@@ -238,7 +240,8 @@ void PluginDownloadUrlHelper::OnReadCompleted(URLRequest* request,
 
   while (request->status().is_success()) {
     unsigned long bytes_written = 0;
-    BOOL write_result = WriteFile(download_file_, download_file_buffer_,
+    BOOL write_result = WriteFile(download_file_,
+                                  download_file_buffer_->data(),
                                   request_bytes_read, &bytes_written, NULL);
     DCHECK(!write_result || (bytes_written == request_bytes_read));
 
@@ -249,7 +252,7 @@ void PluginDownloadUrlHelper::OnReadCompleted(URLRequest* request,
 
     // Start reading
     request_bytes_read = 0;
-    if (!request->Read(download_file_buffer_, arraysize(download_file_buffer_),
+    if (!request->Read(download_file_buffer_, kDownloadFileBufferSize,
                        &request_bytes_read)) {
       if (!request->status().is_io_pending()) {
         // If the error is not an IO pending, then we're done