Change URLRequest to use a ref-counted buffer for actual IO.

This will re-land http://codereview.chromium.org/18390

BUG=5325

Review URL: http://codereview.chromium.org/19004

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@8847 0039d316-1c4b-4281-b951-d872f2087c98

18 files changed, 124 insertions, 81 deletions

diff --git a/chrome/browser/renderer_host/async_resource_handler.cc b/chrome/browser/renderer_host/async_resource_handler.cc
index a59f61e..61489d3 100644
--- a/chrome/browser/renderer_host/async_resource_handler.cc
+++ b/chrome/browser/renderer_host/async_resource_handler.cc
@@ -5,8 +5,31 @@
 #include "chrome/browser/renderer_host/async_resource_handler.h"
 
 #include "base/process.h"
+#include "net/base/io_buffer.h"
+
+SharedIOBuffer* AsyncResourceHandler::spare_read_buffer_;
+
+// Our version of IOBuffer that uses shared memory.
+class SharedIOBuffer : public net::IOBuffer {
+ public:
+  SharedIOBuffer(int buffer_size) : net::IOBuffer(NULL), ok_(false) {
+    if (shared_memory_.Create(std::wstring(), false, false, buffer_size) &&
+        shared_memory_.Map(buffer_size)) {
+      ok_ = true;
+      data_ = reinterpret_cast<char*>(shared_memory_.memory());
+    }
+  }
+  ~SharedIOBuffer() {
+    data_ = NULL;
+  }
 
-base::SharedMemory* AsyncResourceHandler::spare_read_buffer_;
+  base::SharedMemory* shared_memory() { return &shared_memory_; }
+  bool ok() { return ok_; }
+
+ private:
+  base::SharedMemory shared_memory_;
+  bool ok_;
+};
 
 AsyncResourceHandler::AsyncResourceHandler(
     ResourceDispatcherHost::Receiver* receiver,
@@ -44,22 +67,19 @@ bool AsyncResourceHandler::OnResponseStarted(int request_id,
   return true;
 }
 
-bool AsyncResourceHandler::OnWillRead(int request_id,
-                                      char** buf, int* buf_size,
-                                      int min_size) {
+bool AsyncResourceHandler::OnWillRead(int request_id, net::IOBuffer** buf,
+                                      int* buf_size, int min_size) {
   DCHECK(min_size == -1);
   static const int kReadBufSize = 32768;
   if (spare_read_buffer_) {
-    read_buffer_.reset(spare_read_buffer_);
-    spare_read_buffer_ = NULL;
+    DCHECK(!read_buffer_);
+    read_buffer_.swap(&spare_read_buffer_);
   } else {
-    read_buffer_.reset(new base::SharedMemory);
-    if (!read_buffer_->Create(std::wstring(), false, false, kReadBufSize))
-      return false;
-    if (!read_buffer_->Map(kReadBufSize))
+    read_buffer_ = new SharedIOBuffer(kReadBufSize);
+    if (!read_buffer_->ok())
       return false;
   }
-  *buf = static_cast<char*>(read_buffer_->memory());
+  *buf = read_buffer_.get();
   *buf_size = kReadBufSize;
   return true;
 }
@@ -75,7 +95,7 @@ bool AsyncResourceHandler::OnReadCompleted(int request_id, int* bytes_read) {
   }
 
   base::SharedMemoryHandle handle;
-  if (!read_buffer_->GiveToProcess(render_process_, &handle)) {
+  if (!read_buffer_->shared_memory()->GiveToProcess(render_process_, &handle)) {
     // We wrongfully incremented the pending data count. Fake an ACK message
     // to fix this. We can't move this call above the WillSendData because
     // it's killing our read_buffer_, and we don't want that when we pause
@@ -83,6 +103,8 @@ bool AsyncResourceHandler::OnReadCompleted(int request_id, int* bytes_read) {
     rdh_->OnDataReceivedACK(render_process_host_id_, request_id);
     return false;
   }
+  // We just unmapped the memory.
+  read_buffer_ = NULL;
 
   receiver_->Send(new ViewMsg_Resource_DataReceived(
       routing_id_, request_id, handle, *bytes_read));
@@ -97,15 +119,14 @@ bool AsyncResourceHandler::OnResponseCompleted(int request_id,
 
   // If we still have a read buffer, then see about caching it for later...
   if (spare_read_buffer_) {
-    read_buffer_.reset();
-  } else if (read_buffer_.get() && read_buffer_->memory()) {
-    spare_read_buffer_ = read_buffer_.release();
+    read_buffer_ = NULL;
+  } else if (read_buffer_.get()) {
+    read_buffer_.swap(&spare_read_buffer_);
   }
   return true;
 }
 
 // static
 void AsyncResourceHandler::GlobalCleanup() {
-  delete spare_read_buffer_;
   spare_read_buffer_ = NULL;
 }
diff --git a/chrome/browser/renderer_host/async_resource_handler.h b/chrome/browser/renderer_host/async_resource_handler.h
index 618e518..e966a80 100644
--- a/chrome/browser/renderer_host/async_resource_handler.h
+++ b/chrome/browser/renderer_host/async_resource_handler.h
@@ -9,9 +9,7 @@
 #include "chrome/browser/renderer_host/resource_dispatcher_host.h"
 #include "chrome/browser/renderer_host/resource_handler.h"
 
-namespace base {
-class SharedMemory;
-}
+class SharedIOBuffer;
 
 // Used to complete an asynchronous resource request in response to resource
 // load events from the resource dispatcher host.
@@ -28,7 +26,8 @@ class AsyncResourceHandler : public ResourceHandler {
   bool OnUploadProgress(int request_id, uint64 position, uint64 size);
   bool OnRequestRedirected(int request_id, const GURL& new_url);
   bool OnResponseStarted(int request_id, ResourceResponse* response);
-  bool OnWillRead(int request_id, char** buf, int* buf_size, int min_size);
+  bool OnWillRead(int request_id, net::IOBuffer** buf, int* buf_size,
+                  int min_size);
   bool OnReadCompleted(int request_id, int* bytes_read);
   bool OnResponseCompleted(int request_id, const URLRequestStatus& status);
 
@@ -38,9 +37,9 @@ class AsyncResourceHandler : public ResourceHandler {
   // When reading, we don't know if we are going to get EOF (0 bytes read), so
   // we typically have a buffer that we allocated but did not use.  We keep
   // this buffer around for the next read as a small optimization.
-  static base::SharedMemory* spare_read_buffer_;
+  static SharedIOBuffer* spare_read_buffer_;
 
-  scoped_ptr<base::SharedMemory> read_buffer_;
+  scoped_refptr<SharedIOBuffer> read_buffer_;
   ResourceDispatcherHost::Receiver* receiver_;
   int render_process_host_id_;
   int routing_id_;
diff --git a/chrome/browser/renderer_host/buffered_resource_handler.cc b/chrome/browser/renderer_host/buffered_resource_handler.cc
index ea7d69d..d8f66a8 100644
--- a/chrome/browser/renderer_host/buffered_resource_handler.cc
+++ b/chrome/browser/renderer_host/buffered_resource_handler.cc
@@ -8,9 +8,13 @@
 #include "net/base/mime_sniffer.h"
 #include "chrome/browser/renderer_host/download_throttling_resource_handler.h"
 #include "chrome/browser/renderer_host/resource_dispatcher_host.h"
+#include "net/base/mime_sniffer.h"
+#include "net/base/io_buffer.h"
 
 namespace {
 
+const int kMaxBytesToSniff = 512;
+
 void RecordSnifferMetrics(bool sniffing_blocked,
                           bool we_would_like_to_sniff,
                           const std::string& mime_type) {
@@ -71,13 +75,13 @@ bool BufferedResourceHandler::OnResponseCompleted(
 
 // We'll let the original event handler provide a buffer, and reuse it for
 // subsequent reads until we're done buffering.
-bool BufferedResourceHandler::OnWillRead(int request_id,
-                                         char** buf, int* buf_size,
-                                         int min_size) {
+bool BufferedResourceHandler::OnWillRead(int request_id, net::IOBuffer** buf,
+                                         int* buf_size, int min_size) {
   if (buffering_) {
-    *buf = read_buffer_ + bytes_read_;
-    *buf_size = read_buffer_size_ - bytes_read_;
-    DCHECK(*buf_size > 0);
+    DCHECK(!my_buffer_.get());
+    my_buffer_ = new net::IOBuffer(kMaxBytesToSniff);
+    *buf = my_buffer_.get();
+    *buf_size = kMaxBytesToSniff;
     return true;
   }
 
@@ -87,6 +91,7 @@ bool BufferedResourceHandler::OnWillRead(int request_id,
   bool ret = real_handler_->OnWillRead(request_id, buf, buf_size, min_size);
   read_buffer_ = *buf;
   read_buffer_size_ = *buf_size;
+  DCHECK(read_buffer_size_ >= kMaxBytesToSniff * 2); 
   bytes_read_ = 0;
   return ret;
 }
@@ -105,6 +110,8 @@ bool BufferedResourceHandler::OnReadCompleted(int request_id, int* bytes_read) {
       return false;
   }
 
+  // Release the reference that we acquired at OnWillRead.
+  read_buffer_ = NULL;
   return real_handler_->OnReadCompleted(request_id, bytes_read);
 }
 
@@ -168,6 +175,12 @@ bool BufferedResourceHandler::ShouldBuffer(const GURL& url,
 
 bool BufferedResourceHandler::KeepBuffering(int bytes_read) {
   DCHECK(read_buffer_);
+  if (my_buffer_) {
+    // We are using our own buffer to read, update the main buffer.
+    CHECK(bytes_read + bytes_read_ < read_buffer_size_);
+    memcpy(read_buffer_->data() + bytes_read_, my_buffer_->data(), bytes_read);
+    my_buffer_ = NULL;
+  }
   bytes_read_ += bytes_read;
   finished_ = (bytes_read == 0);
 
@@ -175,12 +188,12 @@ bool BufferedResourceHandler::KeepBuffering(int bytes_read) {
     std::string type_hint, new_type;
     request_->GetMimeType(&type_hint);
 
-    if (!net::SniffMimeType(read_buffer_, bytes_read_, request_->url(),
-                            type_hint, &new_type)) {
+    if (!net::SniffMimeType(read_buffer_->data(), bytes_read_,
+                            request_->url(), type_hint, &new_type)) {
       // SniffMimeType() returns false if there is not enough data to determine
       // the mime type. However, even if it returns false, it returns a new type
       // that is probably better than the current one.
-      DCHECK(bytes_read_ < 512 /*kMaxBytesToSniff*/);
+      DCHECK(bytes_read_ < kMaxBytesToSniff);
       if (!finished_) {
         buffering_ = true;
         return true;
@@ -243,11 +256,11 @@ bool BufferedResourceHandler::CompleteResponseStarted(int request_id,
     if (bytes_read_) {
       // a Read has already occurred and we need to copy the data into the
       // EventHandler.
-      char *buf = NULL;
+      net::IOBuffer* buf = NULL;
       int buf_len = 0;
       download_handler->OnWillRead(request_id, &buf, &buf_len, bytes_read_);
       CHECK((buf_len >= bytes_read_) && (bytes_read_ >= 0));
-      memcpy(buf, read_buffer_, bytes_read_);
+      memcpy(buf->data(), read_buffer_->data(), bytes_read_);
     }
     // Update the renderer with the response headers which will cause it to
     // cancel the request.
diff --git a/chrome/browser/renderer_host/buffered_resource_handler.h b/chrome/browser/renderer_host/buffered_resource_handler.h
index 0b832a9..a612722 100644
--- a/chrome/browser/renderer_host/buffered_resource_handler.h
+++ b/chrome/browser/renderer_host/buffered_resource_handler.h
@@ -22,7 +22,8 @@ class BufferedResourceHandler : public ResourceHandler {
   bool OnUploadProgress(int request_id, uint64 position, uint64 size);
   bool OnRequestRedirected(int request_id, const GURL& new_url);
   bool OnResponseStarted(int request_id, ResourceResponse* response);
-  bool OnWillRead(int request_id, char** buf, int* buf_size, int min_size);
+  bool OnWillRead(int request_id, net::IOBuffer** buf, int* buf_size,
+                  int min_size);
   bool OnReadCompleted(int request_id, int* bytes_read);
   bool OnResponseCompleted(int request_id, const URLRequestStatus& status);
 
@@ -48,7 +49,8 @@ class BufferedResourceHandler : public ResourceHandler {
   scoped_refptr<ResourceResponse> response_;
   ResourceDispatcherHost* host_;
   URLRequest* request_;
-  char* read_buffer_;
+  scoped_refptr<net::IOBuffer> read_buffer_;
+  scoped_refptr<net::IOBuffer> my_buffer_;
   int read_buffer_size_;
   int bytes_read_;
   bool sniff_content_;
diff --git a/chrome/browser/renderer_host/cross_site_resource_handler.cc b/chrome/browser/renderer_host/cross_site_resource_handler.cc
index a172352..363d451 100644
--- a/chrome/browser/renderer_host/cross_site_resource_handler.cc
+++ b/chrome/browser/renderer_host/cross_site_resource_handler.cc
@@ -114,9 +114,8 @@ bool CrossSiteResourceHandler::OnResponseStarted(int request_id,
   return true;
 }
 
-bool CrossSiteResourceHandler::OnWillRead(int request_id,
-                                          char** buf, int* buf_size,
-                                          int min_size) {
+bool CrossSiteResourceHandler::OnWillRead(int request_id, net::IOBuffer** buf,
+                                          int* buf_size, int min_size) {
   return next_handler_->OnWillRead(request_id, buf, buf_size, min_size);
 }
 
diff --git a/chrome/browser/renderer_host/cross_site_resource_handler.h b/chrome/browser/renderer_host/cross_site_resource_handler.h
index 7801352..7d57c76 100644
--- a/chrome/browser/renderer_host/cross_site_resource_handler.h
+++ b/chrome/browser/renderer_host/cross_site_resource_handler.h
@@ -24,7 +24,8 @@ class CrossSiteResourceHandler : public ResourceHandler {
   bool OnRequestRedirected(int request_id, const GURL& new_url);
   bool OnResponseStarted(int request_id,
                          ResourceResponse* response);
-  bool OnWillRead(int request_id, char** buf, int* buf_size, int min_size);
+  bool OnWillRead(int request_id, net::IOBuffer** buf, int* buf_size,
+                  int min_size);
   bool OnReadCompleted(int request_id, int* bytes_read);
   bool OnResponseCompleted(int request_id, const URLRequestStatus& status);
 
diff --git a/chrome/browser/renderer_host/download_resource_handler.cc b/chrome/browser/renderer_host/download_resource_handler.cc
index 13e7457..01704e7 100644
--- a/chrome/browser/renderer_host/download_resource_handler.cc
+++ b/chrome/browser/renderer_host/download_resource_handler.cc
@@ -7,6 +7,7 @@
 #include "chrome/browser/download/download_file.h"
 #include "chrome/browser/download/download_manager.h"
 #include "chrome/browser/renderer_host/resource_dispatcher_host.h"
+#include "net/base/io_buffer.h"
 
 DownloadResourceHandler::DownloadResourceHandler(ResourceDispatcherHost* rdh,
                                                  int render_process_host_id,
@@ -20,7 +21,6 @@ DownloadResourceHandler::DownloadResourceHandler(ResourceDispatcherHost* rdh,
       global_id_(ResourceDispatcherHost::GlobalRequestID(render_process_host_id,
                                                          request_id)),
       render_view_id_(render_view_id),
-      read_buffer_(NULL),
       url_(UTF8ToWide(url)),
       content_length_(0),
       download_manager_(manager),
@@ -72,15 +72,14 @@ bool DownloadResourceHandler::OnResponseStarted(int request_id,
 
 // Create a new buffer, which will be handed to the download thread for file
 // writing and deletion.
-bool DownloadResourceHandler::OnWillRead(int request_id,
-                                         char** buf, int* buf_size,
-                                         int min_size) {
+bool DownloadResourceHandler::OnWillRead(int request_id, net::IOBuffer** buf,
+                                         int* buf_size, int min_size) {
   DCHECK(buf && buf_size);
   if (!read_buffer_) {
     *buf_size = min_size < 0 ? kReadBufSize : min_size;
-    read_buffer_ = new char[*buf_size];
+    read_buffer_ = new net::IOBuffer(*buf_size);
   }
-  *buf = read_buffer_;
+  *buf = read_buffer_.get();
   return true;
 }
 
@@ -91,7 +90,11 @@ bool DownloadResourceHandler::OnReadCompleted(int request_id, int* bytes_read) {
   DCHECK(read_buffer_);
   AutoLock auto_lock(buffer_->lock);
   bool need_update = buffer_->contents.empty();
-  buffer_->contents.push_back(std::make_pair(read_buffer_, *bytes_read));
+
+  // We are passing ownership of this buffer to the download file manager.
+  net::IOBuffer* buffer = NULL;
+  read_buffer_.swap(&buffer);
+  buffer_->contents.push_back(std::make_pair(buffer, *bytes_read));
   if (need_update) {
     download_manager_->file_loop()->PostTask(FROM_HERE,
         NewRunnableMethod(download_manager_,
@@ -99,7 +102,6 @@ bool DownloadResourceHandler::OnReadCompleted(int request_id, int* bytes_read) {
                           download_id_,
                           buffer_));
   }
-  read_buffer_ = NULL;
 
   // We schedule a pause outside of the read loop if there is too much file
   // writing work to do.
@@ -117,7 +119,7 @@ bool DownloadResourceHandler::OnResponseCompleted(
                         &DownloadFileManager::DownloadFinished,
                         download_id_,
                         buffer_));
-  delete [] read_buffer_;
+  read_buffer_ = NULL;
 
   // 'buffer_' is deleted by the DownloadFileManager.
   buffer_ = NULL;
diff --git a/chrome/browser/renderer_host/download_resource_handler.h b/chrome/browser/renderer_host/download_resource_handler.h
index b666df6..0dbeef0 100644
--- a/chrome/browser/renderer_host/download_resource_handler.h
+++ b/chrome/browser/renderer_host/download_resource_handler.h
@@ -32,7 +32,8 @@ class DownloadResourceHandler : public ResourceHandler {
 
   // Create a new buffer, which will be handed to the download thread for file
   // writing and deletion.
-  bool OnWillRead(int request_id, char** buf, int* buf_size, int min_size);
+  bool OnWillRead(int request_id, net::IOBuffer** buf, int* buf_size,
+                  int min_size);
 
   bool OnReadCompleted(int request_id, int* bytes_read);
 
@@ -53,7 +54,7 @@ class DownloadResourceHandler : public ResourceHandler {
   int download_id_;
   ResourceDispatcherHost::GlobalRequestID global_id_;
   int render_view_id_;
-  char* read_buffer_;
+  scoped_refptr<net::IOBuffer> read_buffer_;
   std::string content_disposition_;
   std::wstring url_;
   int64 content_length_;
diff --git a/chrome/browser/renderer_host/download_throttling_resource_handler.cc b/chrome/browser/renderer_host/download_throttling_resource_handler.cc
index 07b8164..ea4fdbb 100644
--- a/chrome/browser/renderer_host/download_throttling_resource_handler.cc
+++ b/chrome/browser/renderer_host/download_throttling_resource_handler.cc
@@ -5,6 +5,7 @@
 #include "chrome/browser/renderer_host/download_throttling_resource_handler.h"
 
 #include "chrome/browser/renderer_host/download_resource_handler.h"
+#include "net/base/io_buffer.h"
 
 DownloadThrottlingResourceHandler::DownloadThrottlingResourceHandler(
     ResourceDispatcherHost* host,
@@ -57,7 +58,7 @@ bool DownloadThrottlingResourceHandler::OnResponseStarted(
 }
 
 bool DownloadThrottlingResourceHandler::OnWillRead(int request_id,
-                                                   char** buf,
+                                                   net::IOBuffer** buf,
                                                    int* buf_size,
                                                    int min_size) {
   if (download_handler_.get())
@@ -68,7 +69,7 @@ bool DownloadThrottlingResourceHandler::OnWillRead(int request_id,
   DCHECK(!tmp_buffer_.get());
   if (min_size < 0)
     min_size = 1024;
-  tmp_buffer_.reset(new char[min_size]);
+  tmp_buffer_ = new net::IOBuffer(min_size);
   *buf = tmp_buffer_.get();
   *buf_size = min_size;
   return true;
@@ -132,14 +133,14 @@ void DownloadThrottlingResourceHandler::ContinueDownload() {
 
 void DownloadThrottlingResourceHandler::CopyTmpBufferToDownloadHandler() {
   // Copy over the tmp buffer.
-  char* buffer;
+  net::IOBuffer* buffer;
   int buf_size;
   if (download_handler_->OnWillRead(request_id_, &buffer, &buf_size,
                                     tmp_buffer_length_)) {
     CHECK(buf_size >= tmp_buffer_length_);
-    memcpy(buffer, tmp_buffer_.get(), tmp_buffer_length_);
+    memcpy(buffer->data(), tmp_buffer_->data(), tmp_buffer_length_);
     download_handler_->OnReadCompleted(request_id_, &tmp_buffer_length_);
   }
   tmp_buffer_length_ = 0;
-  tmp_buffer_.reset();
+  tmp_buffer_ = NULL;
 }
diff --git a/chrome/browser/renderer_host/download_throttling_resource_handler.h b/chrome/browser/renderer_host/download_throttling_resource_handler.h
index 177f4fd..97b2942 100644
--- a/chrome/browser/renderer_host/download_throttling_resource_handler.h
+++ b/chrome/browser/renderer_host/download_throttling_resource_handler.h
@@ -40,9 +40,7 @@ class DownloadThrottlingResourceHandler
                                 uint64 size);
   virtual bool OnRequestRedirected(int request_id, const GURL& url);
   virtual bool OnResponseStarted(int request_id, ResourceResponse* response);
-  virtual bool OnWillRead(int request_id,
-                          char** buf,
-                          int* buf_size,
+  virtual bool OnWillRead(int request_id, net::IOBuffer** buf, int* buf_size,
                           int min_size);
   virtual bool OnReadCompleted(int request_id, int* bytes_read);
   virtual bool OnResponseCompleted(int request_id,
@@ -72,7 +70,7 @@ class DownloadThrottlingResourceHandler
 
   // If we're created by way of BufferedEventHandler we'll get one request for
   // a buffer. This is that buffer.
-  scoped_array<char> tmp_buffer_;
+  scoped_refptr<net::IOBuffer> tmp_buffer_;
   int tmp_buffer_length_;
 
   // If true the next call to OnReadCompleted is ignored. This is used if we're
diff --git a/chrome/browser/renderer_host/resource_dispatcher_host.cc b/chrome/browser/renderer_host/resource_dispatcher_host.cc
index 58d823f..50368c0 100644
--- a/chrome/browser/renderer_host/resource_dispatcher_host.cc
+++ b/chrome/browser/renderer_host/resource_dispatcher_host.cc
@@ -928,7 +928,7 @@ bool ResourceDispatcherHost::Read(URLRequest* request, int* bytes_read) {
   ExtraRequestInfo* info = ExtraInfoForRequest(request);
   DCHECK(!info->is_paused);
 
-  char* buf;
+  net::IOBuffer* buf;
   int buf_size;
   if (!info->resource_handler->OnWillRead(info->request_id,
                                           &buf, &buf_size, -1)) {
diff --git a/chrome/browser/renderer_host/resource_handler.h b/chrome/browser/renderer_host/resource_handler.h
index a6955c7..9813094 100644
--- a/chrome/browser/renderer_host/resource_handler.h
+++ b/chrome/browser/renderer_host/resource_handler.h
@@ -49,7 +49,7 @@ class ResourceHandler : public base::RefCounted<ResourceHandler> {
   // out-params.  This call will be followed by either OnReadCompleted or
   // OnResponseCompleted, at which point the buffer may be recycled.
   virtual bool OnWillRead(int request_id,
-                          char** buf,
+                          net::IOBuffer** buf,
                           int* buf_size,
                           int min_size) = 0;
 
diff --git a/chrome/browser/renderer_host/safe_browsing_resource_handler.cc b/chrome/browser/renderer_host/safe_browsing_resource_handler.cc
index 3ca7b38..7ee4661 100644
--- a/chrome/browser/renderer_host/safe_browsing_resource_handler.cc
+++ b/chrome/browser/renderer_host/safe_browsing_resource_handler.cc
@@ -77,7 +77,7 @@ void SafeBrowsingResourceHandler::OnGetHashTimeout() {
 }
 
 bool SafeBrowsingResourceHandler::OnWillRead(int request_id,
-                                             char** buf, int* buf_size,
+                                             net::IOBuffer** buf, int* buf_size,
                                              int min_size) {
   if (in_safe_browsing_check_ && pause_time_.is_null()) {
     pause_time_ = base::Time::Now();
diff --git a/chrome/browser/renderer_host/safe_browsing_resource_handler.h b/chrome/browser/renderer_host/safe_browsing_resource_handler.h
index 244df8b..92e0040 100644
--- a/chrome/browser/renderer_host/safe_browsing_resource_handler.h
+++ b/chrome/browser/renderer_host/safe_browsing_resource_handler.h
@@ -28,7 +28,8 @@ class SafeBrowsingResourceHandler : public ResourceHandler,
   bool OnRequestRedirected(int request_id, const GURL& new_url);
   bool OnResponseStarted(int request_id, ResourceResponse* response);
   void OnGetHashTimeout();
-  bool OnWillRead(int request_id, char** buf, int* buf_size, int min_size);
+  bool OnWillRead(int request_id, net::IOBuffer** buf, int* buf_size,
+                  int min_size);
   bool OnReadCompleted(int request_id, int* bytes_read);
   bool OnResponseCompleted(int request_id, const URLRequestStatus& status);
 
diff --git a/chrome/browser/renderer_host/save_file_resource_handler.cc b/chrome/browser/renderer_host/save_file_resource_handler.cc
index 420b28a..2520961 100644
--- a/chrome/browser/renderer_host/save_file_resource_handler.cc
+++ b/chrome/browser/renderer_host/save_file_resource_handler.cc
@@ -5,6 +5,7 @@
 #include "chrome/browser/renderer_host/save_file_resource_handler.h"
 
 #include "chrome/browser/download/save_file_manager.h"
+#include "net/base/io_buffer.h"
 
 SaveFileResourceHandler::SaveFileResourceHandler(int render_process_host_id,
                                                  int render_view_id,
@@ -13,7 +14,6 @@ SaveFileResourceHandler::SaveFileResourceHandler(int render_process_host_id,
     : save_id_(-1),
       render_process_id_(render_process_host_id),
       render_view_id_(render_view_id),
-      read_buffer_(NULL),
       url_(UTF8ToWide(url)),
       content_length_(0),
       save_manager_(manager) {
@@ -46,27 +46,28 @@ bool SaveFileResourceHandler::OnResponseStarted(int request_id,
   return true;
 }
 
-bool SaveFileResourceHandler::OnWillRead(int request_id,
-                                         char** buf, int* buf_size,
-                                         int min_size) {
+bool SaveFileResourceHandler::OnWillRead(int request_id, net::IOBuffer** buf,
+                                         int* buf_size, int min_size) {
   DCHECK(buf && buf_size);
   if (!read_buffer_) {
     *buf_size = min_size < 0 ? kReadBufSize : min_size;
-    read_buffer_ = new char[*buf_size];
+    read_buffer_ = new net::IOBuffer(*buf_size);
   }
-  *buf = read_buffer_;
+  *buf = read_buffer_.get();
   return true;
 }
 
 bool SaveFileResourceHandler::OnReadCompleted(int request_id, int* bytes_read) {
   DCHECK(read_buffer_);
+  // We are passing ownership of this buffer to the save file manager.
+  net::IOBuffer* buffer = NULL;
+  read_buffer_.swap(&buffer);
   save_manager_->GetSaveLoop()->PostTask(FROM_HERE,
       NewRunnableMethod(save_manager_,
                         &SaveFileManager::UpdateSaveProgress,
                         save_id_,
-                        read_buffer_,
+                        buffer,
                         *bytes_read));
-  read_buffer_ = NULL;
   return true;
 }
 
@@ -80,6 +81,6 @@ bool SaveFileResourceHandler::OnResponseCompleted(
                         url_,
                         render_process_id_,
                         status.is_success() && !status.is_io_pending()));
-  delete [] read_buffer_;
+  read_buffer_ = NULL;
   return true;
 }
diff --git a/chrome/browser/renderer_host/save_file_resource_handler.h b/chrome/browser/renderer_host/save_file_resource_handler.h
index 87f06ae..30fc074 100644
--- a/chrome/browser/renderer_host/save_file_resource_handler.h
+++ b/chrome/browser/renderer_host/save_file_resource_handler.h
@@ -28,7 +28,8 @@ class SaveFileResourceHandler : public ResourceHandler {
 
   // Creates a new buffer, which will be handed to the download thread for file
   // writing and deletion.
-  bool OnWillRead(int request_id, char** buf, int* buf_size, int min_size);
+  bool OnWillRead(int request_id, net::IOBuffer** buf, int* buf_size,
+                  int min_size);
 
   // Passes the buffer to the download file writer.
   bool OnReadCompleted(int request_id, int* bytes_read);
@@ -50,7 +51,7 @@ class SaveFileResourceHandler : public ResourceHandler {
   int save_id_;
   int render_process_id_;
   int render_view_id_;
-  char* read_buffer_;
+  scoped_refptr<net::IOBuffer> read_buffer_;
   std::string content_disposition_;
   std::wstring url_;
   std::wstring final_url_;
diff --git a/chrome/browser/renderer_host/sync_resource_handler.cc b/chrome/browser/renderer_host/sync_resource_handler.cc
index aace1c1..a30f10f 100644
--- a/chrome/browser/renderer_host/sync_resource_handler.cc
+++ b/chrome/browser/renderer_host/sync_resource_handler.cc
@@ -8,7 +8,8 @@ SyncResourceHandler::SyncResourceHandler(
     ResourceDispatcherHost::Receiver* receiver,
     const GURL& url,
     IPC::Message* result_message)
-    : receiver_(receiver),
+    : read_buffer_(new net::IOBuffer(kReadBufSize)),
+      receiver_(receiver),
       result_message_(result_message) {
   result_.final_url = url;
   result_.filter_policy = FilterPolicy::DONT_FILTER;
@@ -29,10 +30,10 @@ bool SyncResourceHandler::OnResponseStarted(int request_id,
   return true;
 }
 
-bool SyncResourceHandler::OnWillRead(int request_id,
-                                     char** buf, int* buf_size, int min_size) {
+bool SyncResourceHandler::OnWillRead(int request_id, net::IOBuffer** buf,
+                                     int* buf_size, int min_size) {
   DCHECK(min_size == -1);
-  *buf = read_buffer_;
+  *buf = read_buffer_.get();
   *buf_size = kReadBufSize;
   return true;
 }
@@ -40,7 +41,7 @@ bool SyncResourceHandler::OnWillRead(int request_id,
 bool SyncResourceHandler::OnReadCompleted(int request_id, int* bytes_read) {
   if (!*bytes_read)
     return true;
-  result_.data.append(read_buffer_, *bytes_read);
+  result_.data.append(read_buffer_->data(), *bytes_read);
   return true;
 }
 
diff --git a/chrome/browser/renderer_host/sync_resource_handler.h b/chrome/browser/renderer_host/sync_resource_handler.h
index 81a6078..012ab9e 100644
--- a/chrome/browser/renderer_host/sync_resource_handler.h
+++ b/chrome/browser/renderer_host/sync_resource_handler.h
@@ -7,6 +7,7 @@
 
 #include "chrome/browser/renderer_host/resource_dispatcher_host.h"
 #include "chrome/browser/renderer_host/resource_handler.h"
+#include "net/base/io_buffer.h"
 
 // Used to complete a synchronous resource request in response to resource load
 // events from the resource dispatcher host.
@@ -18,13 +19,14 @@ class SyncResourceHandler : public ResourceHandler {
 
   bool OnRequestRedirected(int request_id, const GURL& new_url);
   bool OnResponseStarted(int request_id, ResourceResponse* response);
-  bool OnWillRead(int request_id, char** buf, int* buf_size, int min_size);
+  bool OnWillRead(int request_id, net::IOBuffer** buf, int* buf_size,
+                  int min_size);
   bool OnReadCompleted(int request_id, int* bytes_read);
   bool OnResponseCompleted(int request_id, const URLRequestStatus& status);
 
  private:
   enum { kReadBufSize = 3840 };
-  char read_buffer_[kReadBufSize];
+  scoped_refptr<net::IOBuffer> read_buffer_;
 
   ViewHostMsg_SyncLoad_Result result_;
   ResourceDispatcherHost::Receiver* receiver_;