Change URLRequest to use a ref-counted buffer for actual IO.The ref-counting will prevent the deletion / reuse of memorywhile the buffer is actually being used by pending IO.This seems a very intrusive change, but at least we will be ableto make sure that it works without having to chase every singledestruction of an URLRequest to make sure that any pending IOwas cancelled, and also allows us to avoid blocking onthe object destruction.BUG=5325

Review URL: http://codereview.chromium.org/18390

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@8603 0039d316-1c4b-4281-b951-d872f2087c98

18 files changed, 119 insertions, 80 deletions

diff --git a/chrome/browser/renderer_host/async_resource_handler.cc b/chrome/browser/renderer_host/async_resource_handler.cc
index a59f61e..814415e 100644
--- a/chrome/browser/renderer_host/async_resource_handler.cc
+++ b/chrome/browser/renderer_host/async_resource_handler.cc
@@ -5,8 +5,31 @@
 #include "chrome/browser/renderer_host/async_resource_handler.h"
 
 #include "base/process.h"
+#include "net/base/io_buffer.h"
+
+SharedIOBuffer* AsyncResourceHandler::spare_read_buffer_;
+
+// Our version of IOBuffer that uses shared memory.
+class SharedIOBuffer : public net::IOBuffer {
+ public:
+  SharedIOBuffer(int buffer_size) : net::IOBuffer(NULL), ok_(false) {
+    if (shared_memory_.Create(std::wstring(), false, false, buffer_size) &&
+        shared_memory_.Map(buffer_size)) {
+      ok_ = true;
+      data_ = reinterpret_cast<char*>(shared_memory_.memory());
+    }
+  }
+  ~SharedIOBuffer() {
+    data_ = NULL;
+  }
 
-base::SharedMemory* AsyncResourceHandler::spare_read_buffer_;
+  base::SharedMemory* shared_memory() { return &shared_memory_; }
+  bool ok() { return ok_; }
+
+ private:
+  base::SharedMemory shared_memory_;
+  bool ok_;
+};
 
 AsyncResourceHandler::AsyncResourceHandler(
     ResourceDispatcherHost::Receiver* receiver,
@@ -44,22 +67,19 @@ bool AsyncResourceHandler::OnResponseStarted(int request_id,
   return true;
 }
 
-bool AsyncResourceHandler::OnWillRead(int request_id,
-                                      char** buf, int* buf_size,
-                                      int min_size) {
+bool AsyncResourceHandler::OnWillRead(int request_id, net::IOBuffer** buf,
+                                      int* buf_size, int min_size) {
   DCHECK(min_size == -1);
   static const int kReadBufSize = 32768;
   if (spare_read_buffer_) {
-    read_buffer_.reset(spare_read_buffer_);
+    read_buffer_ = spare_read_buffer_;
     spare_read_buffer_ = NULL;
   } else {
-    read_buffer_.reset(new base::SharedMemory);
-    if (!read_buffer_->Create(std::wstring(), false, false, kReadBufSize))
-      return false;
-    if (!read_buffer_->Map(kReadBufSize))
+    read_buffer_ = new SharedIOBuffer(kReadBufSize);
+    if (!read_buffer_->ok())
       return false;
   }
-  *buf = static_cast<char*>(read_buffer_->memory());
+  *buf = read_buffer_.get();
   *buf_size = kReadBufSize;
   return true;
 }
@@ -75,7 +95,7 @@ bool AsyncResourceHandler::OnReadCompleted(int request_id, int* bytes_read) {
   }
 
   base::SharedMemoryHandle handle;
-  if (!read_buffer_->GiveToProcess(render_process_, &handle)) {
+  if (!read_buffer_->shared_memory()->GiveToProcess(render_process_, &handle)) {
     // We wrongfully incremented the pending data count. Fake an ACK message
     // to fix this. We can't move this call above the WillSendData because
     // it's killing our read_buffer_, and we don't want that when we pause
@@ -97,15 +117,14 @@ bool AsyncResourceHandler::OnResponseCompleted(int request_id,
 
   // If we still have a read buffer, then see about caching it for later...
   if (spare_read_buffer_) {
-    read_buffer_.reset();
-  } else if (read_buffer_.get() && read_buffer_->memory()) {
-    spare_read_buffer_ = read_buffer_.release();
+    read_buffer_ = NULL;
+  } else if (read_buffer_.get() && read_buffer_->data()) {
+    read_buffer_.swap(&spare_read_buffer_);
   }
   return true;
 }
 
 // static
 void AsyncResourceHandler::GlobalCleanup() {
-  delete spare_read_buffer_;
   spare_read_buffer_ = NULL;
 }
diff --git a/chrome/browser/renderer_host/async_resource_handler.h b/chrome/browser/renderer_host/async_resource_handler.h
index 618e518..e966a80 100644
--- a/chrome/browser/renderer_host/async_resource_handler.h
+++ b/chrome/browser/renderer_host/async_resource_handler.h
@@ -9,9 +9,7 @@
 #include "chrome/browser/renderer_host/resource_dispatcher_host.h"
 #include "chrome/browser/renderer_host/resource_handler.h"
 
-namespace base {
-class SharedMemory;
-}
+class SharedIOBuffer;
 
 // Used to complete an asynchronous resource request in response to resource
 // load events from the resource dispatcher host.
@@ -28,7 +26,8 @@ class AsyncResourceHandler : public ResourceHandler {
   bool OnUploadProgress(int request_id, uint64 position, uint64 size);
   bool OnRequestRedirected(int request_id, const GURL& new_url);
   bool OnResponseStarted(int request_id, ResourceResponse* response);
-  bool OnWillRead(int request_id, char** buf, int* buf_size, int min_size);
+  bool OnWillRead(int request_id, net::IOBuffer** buf, int* buf_size,
+                  int min_size);
   bool OnReadCompleted(int request_id, int* bytes_read);
   bool OnResponseCompleted(int request_id, const URLRequestStatus& status);
 
@@ -38,9 +37,9 @@ class AsyncResourceHandler : public ResourceHandler {
   // When reading, we don't know if we are going to get EOF (0 bytes read), so
   // we typically have a buffer that we allocated but did not use.  We keep
   // this buffer around for the next read as a small optimization.
-  static base::SharedMemory* spare_read_buffer_;
+  static SharedIOBuffer* spare_read_buffer_;
 
-  scoped_ptr<base::SharedMemory> read_buffer_;
+  scoped_refptr<SharedIOBuffer> read_buffer_;
   ResourceDispatcherHost::Receiver* receiver_;
   int render_process_host_id_;
   int routing_id_;
diff --git a/chrome/browser/renderer_host/buffered_resource_handler.cc b/chrome/browser/renderer_host/buffered_resource_handler.cc
index ea7d69d..458dc8c 100644
--- a/chrome/browser/renderer_host/buffered_resource_handler.cc
+++ b/chrome/browser/renderer_host/buffered_resource_handler.cc
@@ -8,9 +8,13 @@
 #include "net/base/mime_sniffer.h"
 #include "chrome/browser/renderer_host/download_throttling_resource_handler.h"
 #include "chrome/browser/renderer_host/resource_dispatcher_host.h"
+#include "net/base/mime_sniffer.h"
+#include "net/base/io_buffer.h"
 
 namespace {
 
+const int kMaxBytesToSniff = 512;
+
 void RecordSnifferMetrics(bool sniffing_blocked,
                           bool we_would_like_to_sniff,
                           const std::string& mime_type) {
@@ -71,13 +75,13 @@ bool BufferedResourceHandler::OnResponseCompleted(
 
 // We'll let the original event handler provide a buffer, and reuse it for
 // subsequent reads until we're done buffering.
-bool BufferedResourceHandler::OnWillRead(int request_id,
-                                         char** buf, int* buf_size,
-                                         int min_size) {
+bool BufferedResourceHandler::OnWillRead(int request_id, net::IOBuffer** buf,
+                                         int* buf_size, int min_size) {
   if (buffering_) {
-    *buf = read_buffer_ + bytes_read_;
-    *buf_size = read_buffer_size_ - bytes_read_;
-    DCHECK(*buf_size > 0);
+    DCHECK(!my_buffer_.get());
+    my_buffer_ = new net::IOBuffer(kMaxBytesToSniff);
+    *buf = my_buffer_.get();
+    *buf_size = kMaxBytesToSniff;
     return true;
   }
 
@@ -87,6 +91,7 @@ bool BufferedResourceHandler::OnWillRead(int request_id,
   bool ret = real_handler_->OnWillRead(request_id, buf, buf_size, min_size);
   read_buffer_ = *buf;
   read_buffer_size_ = *buf_size;
+  DCHECK(read_buffer_size_ >= kMaxBytesToSniff * 2); 
   bytes_read_ = 0;
   return ret;
 }
@@ -168,6 +173,12 @@ bool BufferedResourceHandler::ShouldBuffer(const GURL& url,
 
 bool BufferedResourceHandler::KeepBuffering(int bytes_read) {
   DCHECK(read_buffer_);
+  if (my_buffer_) {
+    // We are using our own buffer to read, update the main buffer.
+    CHECK(bytes_read + bytes_read_ < read_buffer_size_);
+    memcpy(read_buffer_->data() + bytes_read_, my_buffer_->data(), bytes_read);
+    my_buffer_ = NULL;
+  }
   bytes_read_ += bytes_read;
   finished_ = (bytes_read == 0);
 
@@ -175,12 +186,12 @@ bool BufferedResourceHandler::KeepBuffering(int bytes_read) {
     std::string type_hint, new_type;
     request_->GetMimeType(&type_hint);
 
-    if (!net::SniffMimeType(read_buffer_, bytes_read_, request_->url(),
-                            type_hint, &new_type)) {
+    if (!net::SniffMimeType(read_buffer_->data(), bytes_read_,
+                            request_->url(), type_hint, &new_type)) {
       // SniffMimeType() returns false if there is not enough data to determine
       // the mime type. However, even if it returns false, it returns a new type
       // that is probably better than the current one.
-      DCHECK(bytes_read_ < 512 /*kMaxBytesToSniff*/);
+      DCHECK(bytes_read_ < kMaxBytesToSniff);
       if (!finished_) {
         buffering_ = true;
         return true;
@@ -243,11 +254,11 @@ bool BufferedResourceHandler::CompleteResponseStarted(int request_id,
     if (bytes_read_) {
       // a Read has already occurred and we need to copy the data into the
       // EventHandler.
-      char *buf = NULL;
+      net::IOBuffer* buf = NULL;
       int buf_len = 0;
       download_handler->OnWillRead(request_id, &buf, &buf_len, bytes_read_);
       CHECK((buf_len >= bytes_read_) && (bytes_read_ >= 0));
-      memcpy(buf, read_buffer_, bytes_read_);
+      memcpy(buf->data(), read_buffer_->data(), bytes_read_);
     }
     // Update the renderer with the response headers which will cause it to
     // cancel the request.
diff --git a/chrome/browser/renderer_host/buffered_resource_handler.h b/chrome/browser/renderer_host/buffered_resource_handler.h
index 0b832a9..a612722 100644
--- a/chrome/browser/renderer_host/buffered_resource_handler.h
+++ b/chrome/browser/renderer_host/buffered_resource_handler.h
@@ -22,7 +22,8 @@ class BufferedResourceHandler : public ResourceHandler {
   bool OnUploadProgress(int request_id, uint64 position, uint64 size);
   bool OnRequestRedirected(int request_id, const GURL& new_url);
   bool OnResponseStarted(int request_id, ResourceResponse* response);
-  bool OnWillRead(int request_id, char** buf, int* buf_size, int min_size);
+  bool OnWillRead(int request_id, net::IOBuffer** buf, int* buf_size,
+                  int min_size);
   bool OnReadCompleted(int request_id, int* bytes_read);
   bool OnResponseCompleted(int request_id, const URLRequestStatus& status);
 
@@ -48,7 +49,8 @@ class BufferedResourceHandler : public ResourceHandler {
   scoped_refptr<ResourceResponse> response_;
   ResourceDispatcherHost* host_;
   URLRequest* request_;
-  char* read_buffer_;
+  scoped_refptr<net::IOBuffer> read_buffer_;
+  scoped_refptr<net::IOBuffer> my_buffer_;
   int read_buffer_size_;
   int bytes_read_;
   bool sniff_content_;
diff --git a/chrome/browser/renderer_host/cross_site_resource_handler.cc b/chrome/browser/renderer_host/cross_site_resource_handler.cc
index a172352..363d451 100644
--- a/chrome/browser/renderer_host/cross_site_resource_handler.cc
+++ b/chrome/browser/renderer_host/cross_site_resource_handler.cc
@@ -114,9 +114,8 @@ bool CrossSiteResourceHandler::OnResponseStarted(int request_id,
   return true;
 }
 
-bool CrossSiteResourceHandler::OnWillRead(int request_id,
-                                          char** buf, int* buf_size,
-                                          int min_size) {
+bool CrossSiteResourceHandler::OnWillRead(int request_id, net::IOBuffer** buf,
+                                          int* buf_size, int min_size) {
   return next_handler_->OnWillRead(request_id, buf, buf_size, min_size);
 }
 
diff --git a/chrome/browser/renderer_host/cross_site_resource_handler.h b/chrome/browser/renderer_host/cross_site_resource_handler.h
index 7801352..7d57c76 100644
--- a/chrome/browser/renderer_host/cross_site_resource_handler.h
+++ b/chrome/browser/renderer_host/cross_site_resource_handler.h
@@ -24,7 +24,8 @@ class CrossSiteResourceHandler : public ResourceHandler {
   bool OnRequestRedirected(int request_id, const GURL& new_url);
   bool OnResponseStarted(int request_id,
                          ResourceResponse* response);
-  bool OnWillRead(int request_id, char** buf, int* buf_size, int min_size);
+  bool OnWillRead(int request_id, net::IOBuffer** buf, int* buf_size,
+                  int min_size);
   bool OnReadCompleted(int request_id, int* bytes_read);
   bool OnResponseCompleted(int request_id, const URLRequestStatus& status);
 
diff --git a/chrome/browser/renderer_host/download_resource_handler.cc b/chrome/browser/renderer_host/download_resource_handler.cc
index 13e7457..01704e7 100644
--- a/chrome/browser/renderer_host/download_resource_handler.cc
+++ b/chrome/browser/renderer_host/download_resource_handler.cc
@@ -7,6 +7,7 @@
 #include "chrome/browser/download/download_file.h"
 #include "chrome/browser/download/download_manager.h"
 #include "chrome/browser/renderer_host/resource_dispatcher_host.h"
+#include "net/base/io_buffer.h"
 
 DownloadResourceHandler::DownloadResourceHandler(ResourceDispatcherHost* rdh,
                                                  int render_process_host_id,
@@ -20,7 +21,6 @@ DownloadResourceHandler::DownloadResourceHandler(ResourceDispatcherHost* rdh,
       global_id_(ResourceDispatcherHost::GlobalRequestID(render_process_host_id,
                                                          request_id)),
       render_view_id_(render_view_id),
-      read_buffer_(NULL),
       url_(UTF8ToWide(url)),
       content_length_(0),
       download_manager_(manager),
@@ -72,15 +72,14 @@ bool DownloadResourceHandler::OnResponseStarted(int request_id,
 
 // Create a new buffer, which will be handed to the download thread for file
 // writing and deletion.
-bool DownloadResourceHandler::OnWillRead(int request_id,
-                                         char** buf, int* buf_size,
-                                         int min_size) {
+bool DownloadResourceHandler::OnWillRead(int request_id, net::IOBuffer** buf,
+                                         int* buf_size, int min_size) {
   DCHECK(buf && buf_size);
   if (!read_buffer_) {
     *buf_size = min_size < 0 ? kReadBufSize : min_size;
-    read_buffer_ = new char[*buf_size];
+    read_buffer_ = new net::IOBuffer(*buf_size);
   }
-  *buf = read_buffer_;
+  *buf = read_buffer_.get();
   return true;
 }
 
@@ -91,7 +90,11 @@ bool DownloadResourceHandler::OnReadCompleted(int request_id, int* bytes_read) {
   DCHECK(read_buffer_);
   AutoLock auto_lock(buffer_->lock);
   bool need_update = buffer_->contents.empty();
-  buffer_->contents.push_back(std::make_pair(read_buffer_, *bytes_read));
+
+  // We are passing ownership of this buffer to the download file manager.
+  net::IOBuffer* buffer = NULL;
+  read_buffer_.swap(&buffer);
+  buffer_->contents.push_back(std::make_pair(buffer, *bytes_read));
   if (need_update) {
     download_manager_->file_loop()->PostTask(FROM_HERE,
         NewRunnableMethod(download_manager_,
@@ -99,7 +102,6 @@ bool DownloadResourceHandler::OnReadCompleted(int request_id, int* bytes_read) {
                           download_id_,
                           buffer_));
   }
-  read_buffer_ = NULL;
 
   // We schedule a pause outside of the read loop if there is too much file
   // writing work to do.
@@ -117,7 +119,7 @@ bool DownloadResourceHandler::OnResponseCompleted(
                         &DownloadFileManager::DownloadFinished,
                         download_id_,
                         buffer_));
-  delete [] read_buffer_;
+  read_buffer_ = NULL;
 
   // 'buffer_' is deleted by the DownloadFileManager.
   buffer_ = NULL;
diff --git a/chrome/browser/renderer_host/download_resource_handler.h b/chrome/browser/renderer_host/download_resource_handler.h
index b666df6..0dbeef0 100644
--- a/chrome/browser/renderer_host/download_resource_handler.h
+++ b/chrome/browser/renderer_host/download_resource_handler.h
@@ -32,7 +32,8 @@ class DownloadResourceHandler : public ResourceHandler {
 
   // Create a new buffer, which will be handed to the download thread for file
   // writing and deletion.
-  bool OnWillRead(int request_id, char** buf, int* buf_size, int min_size);
+  bool OnWillRead(int request_id, net::IOBuffer** buf, int* buf_size,
+                  int min_size);
 
   bool OnReadCompleted(int request_id, int* bytes_read);
 
@@ -53,7 +54,7 @@ class DownloadResourceHandler : public ResourceHandler {
   int download_id_;
   ResourceDispatcherHost::GlobalRequestID global_id_;
   int render_view_id_;
-  char* read_buffer_;
+  scoped_refptr<net::IOBuffer> read_buffer_;
   std::string content_disposition_;
   std::wstring url_;
   int64 content_length_;
diff --git a/chrome/browser/renderer_host/download_throttling_resource_handler.cc b/chrome/browser/renderer_host/download_throttling_resource_handler.cc
index 07b8164..ea4fdbb 100644
--- a/chrome/browser/renderer_host/download_throttling_resource_handler.cc
+++ b/chrome/browser/renderer_host/download_throttling_resource_handler.cc
@@ -5,6 +5,7 @@
 #include "chrome/browser/renderer_host/download_throttling_resource_handler.h"
 
 #include "chrome/browser/renderer_host/download_resource_handler.h"
+#include "net/base/io_buffer.h"
 
 DownloadThrottlingResourceHandler::DownloadThrottlingResourceHandler(
     ResourceDispatcherHost* host,
@@ -57,7 +58,7 @@ bool DownloadThrottlingResourceHandler::OnResponseStarted(
 }
 
 bool DownloadThrottlingResourceHandler::OnWillRead(int request_id,
-                                                   char** buf,
+                                                   net::IOBuffer** buf,
                                                    int* buf_size,
                                                    int min_size) {
   if (download_handler_.get())
@@ -68,7 +69,7 @@ bool DownloadThrottlingResourceHandler::OnWillRead(int request_id,
   DCHECK(!tmp_buffer_.get());
   if (min_size < 0)
     min_size = 1024;
-  tmp_buffer_.reset(new char[min_size]);
+  tmp_buffer_ = new net::IOBuffer(min_size);
   *buf = tmp_buffer_.get();
   *buf_size = min_size;
   return true;
@@ -132,14 +133,14 @@ void DownloadThrottlingResourceHandler::ContinueDownload() {
 
 void DownloadThrottlingResourceHandler::CopyTmpBufferToDownloadHandler() {
   // Copy over the tmp buffer.
-  char* buffer;
+  net::IOBuffer* buffer;
   int buf_size;
   if (download_handler_->OnWillRead(request_id_, &buffer, &buf_size,
                                     tmp_buffer_length_)) {
     CHECK(buf_size >= tmp_buffer_length_);
-    memcpy(buffer, tmp_buffer_.get(), tmp_buffer_length_);
+    memcpy(buffer->data(), tmp_buffer_->data(), tmp_buffer_length_);
     download_handler_->OnReadCompleted(request_id_, &tmp_buffer_length_);
   }
   tmp_buffer_length_ = 0;
-  tmp_buffer_.reset();
+  tmp_buffer_ = NULL;
 }
diff --git a/chrome/browser/renderer_host/download_throttling_resource_handler.h b/chrome/browser/renderer_host/download_throttling_resource_handler.h
index 177f4fd..97b2942 100644
--- a/chrome/browser/renderer_host/download_throttling_resource_handler.h
+++ b/chrome/browser/renderer_host/download_throttling_resource_handler.h
@@ -40,9 +40,7 @@ class DownloadThrottlingResourceHandler
                                 uint64 size);
   virtual bool OnRequestRedirected(int request_id, const GURL& url);
   virtual bool OnResponseStarted(int request_id, ResourceResponse* response);
-  virtual bool OnWillRead(int request_id,
-                          char** buf,
-                          int* buf_size,
+  virtual bool OnWillRead(int request_id, net::IOBuffer** buf, int* buf_size,
                           int min_size);
   virtual bool OnReadCompleted(int request_id, int* bytes_read);
   virtual bool OnResponseCompleted(int request_id,
@@ -72,7 +70,7 @@ class DownloadThrottlingResourceHandler
 
   // If we're created by way of BufferedEventHandler we'll get one request for
   // a buffer. This is that buffer.
-  scoped_array<char> tmp_buffer_;
+  scoped_refptr<net::IOBuffer> tmp_buffer_;
   int tmp_buffer_length_;
 
   // If true the next call to OnReadCompleted is ignored. This is used if we're
diff --git a/chrome/browser/renderer_host/resource_dispatcher_host.cc b/chrome/browser/renderer_host/resource_dispatcher_host.cc
index 261d1c1..2864d88 100644
--- a/chrome/browser/renderer_host/resource_dispatcher_host.cc
+++ b/chrome/browser/renderer_host/resource_dispatcher_host.cc
@@ -928,7 +928,7 @@ bool ResourceDispatcherHost::Read(URLRequest* request, int* bytes_read) {
   ExtraRequestInfo* info = ExtraInfoForRequest(request);
   DCHECK(!info->is_paused);
 
-  char* buf;
+  net::IOBuffer* buf;
   int buf_size;
   if (!info->resource_handler->OnWillRead(info->request_id,
                                           &buf, &buf_size, -1)) {
diff --git a/chrome/browser/renderer_host/resource_handler.h b/chrome/browser/renderer_host/resource_handler.h
index a6955c7..9813094 100644
--- a/chrome/browser/renderer_host/resource_handler.h
+++ b/chrome/browser/renderer_host/resource_handler.h
@@ -49,7 +49,7 @@ class ResourceHandler : public base::RefCounted<ResourceHandler> {
   // out-params.  This call will be followed by either OnReadCompleted or
   // OnResponseCompleted, at which point the buffer may be recycled.
   virtual bool OnWillRead(int request_id,
-                          char** buf,
+                          net::IOBuffer** buf,
                           int* buf_size,
                           int min_size) = 0;
 
diff --git a/chrome/browser/renderer_host/safe_browsing_resource_handler.cc b/chrome/browser/renderer_host/safe_browsing_resource_handler.cc
index 3ca7b38..7ee4661 100644
--- a/chrome/browser/renderer_host/safe_browsing_resource_handler.cc
+++ b/chrome/browser/renderer_host/safe_browsing_resource_handler.cc
@@ -77,7 +77,7 @@ void SafeBrowsingResourceHandler::OnGetHashTimeout() {
 }
 
 bool SafeBrowsingResourceHandler::OnWillRead(int request_id,
-                                             char** buf, int* buf_size,
+                                             net::IOBuffer** buf, int* buf_size,
                                              int min_size) {
   if (in_safe_browsing_check_ && pause_time_.is_null()) {
     pause_time_ = base::Time::Now();
diff --git a/chrome/browser/renderer_host/safe_browsing_resource_handler.h b/chrome/browser/renderer_host/safe_browsing_resource_handler.h
index 244df8b..92e0040 100644
--- a/chrome/browser/renderer_host/safe_browsing_resource_handler.h
+++ b/chrome/browser/renderer_host/safe_browsing_resource_handler.h
@@ -28,7 +28,8 @@ class SafeBrowsingResourceHandler : public ResourceHandler,
   bool OnRequestRedirected(int request_id, const GURL& new_url);
   bool OnResponseStarted(int request_id, ResourceResponse* response);
   void OnGetHashTimeout();
-  bool OnWillRead(int request_id, char** buf, int* buf_size, int min_size);
+  bool OnWillRead(int request_id, net::IOBuffer** buf, int* buf_size,
+                  int min_size);
   bool OnReadCompleted(int request_id, int* bytes_read);
   bool OnResponseCompleted(int request_id, const URLRequestStatus& status);
 
diff --git a/chrome/browser/renderer_host/save_file_resource_handler.cc b/chrome/browser/renderer_host/save_file_resource_handler.cc
index 420b28a..2520961 100644
--- a/chrome/browser/renderer_host/save_file_resource_handler.cc
+++ b/chrome/browser/renderer_host/save_file_resource_handler.cc
@@ -5,6 +5,7 @@
 #include "chrome/browser/renderer_host/save_file_resource_handler.h"
 
 #include "chrome/browser/download/save_file_manager.h"
+#include "net/base/io_buffer.h"
 
 SaveFileResourceHandler::SaveFileResourceHandler(int render_process_host_id,
                                                  int render_view_id,
@@ -13,7 +14,6 @@ SaveFileResourceHandler::SaveFileResourceHandler(int render_process_host_id,
     : save_id_(-1),
       render_process_id_(render_process_host_id),
       render_view_id_(render_view_id),
-      read_buffer_(NULL),
       url_(UTF8ToWide(url)),
       content_length_(0),
       save_manager_(manager) {
@@ -46,27 +46,28 @@ bool SaveFileResourceHandler::OnResponseStarted(int request_id,
   return true;
 }
 
-bool SaveFileResourceHandler::OnWillRead(int request_id,
-                                         char** buf, int* buf_size,
-                                         int min_size) {
+bool SaveFileResourceHandler::OnWillRead(int request_id, net::IOBuffer** buf,
+                                         int* buf_size, int min_size) {
   DCHECK(buf && buf_size);
   if (!read_buffer_) {
     *buf_size = min_size < 0 ? kReadBufSize : min_size;
-    read_buffer_ = new char[*buf_size];
+    read_buffer_ = new net::IOBuffer(*buf_size);
   }
-  *buf = read_buffer_;
+  *buf = read_buffer_.get();
   return true;
 }
 
 bool SaveFileResourceHandler::OnReadCompleted(int request_id, int* bytes_read) {
   DCHECK(read_buffer_);
+  // We are passing ownership of this buffer to the save file manager.
+  net::IOBuffer* buffer = NULL;
+  read_buffer_.swap(&buffer);
   save_manager_->GetSaveLoop()->PostTask(FROM_HERE,
       NewRunnableMethod(save_manager_,
                         &SaveFileManager::UpdateSaveProgress,
                         save_id_,
-                        read_buffer_,
+                        buffer,
                         *bytes_read));
-  read_buffer_ = NULL;
   return true;
 }
 
@@ -80,6 +81,6 @@ bool SaveFileResourceHandler::OnResponseCompleted(
                         url_,
                         render_process_id_,
                         status.is_success() && !status.is_io_pending()));
-  delete [] read_buffer_;
+  read_buffer_ = NULL;
   return true;
 }
diff --git a/chrome/browser/renderer_host/save_file_resource_handler.h b/chrome/browser/renderer_host/save_file_resource_handler.h
index 87f06ae..30fc074 100644
--- a/chrome/browser/renderer_host/save_file_resource_handler.h
+++ b/chrome/browser/renderer_host/save_file_resource_handler.h
@@ -28,7 +28,8 @@ class SaveFileResourceHandler : public ResourceHandler {
 
   // Creates a new buffer, which will be handed to the download thread for file
   // writing and deletion.
-  bool OnWillRead(int request_id, char** buf, int* buf_size, int min_size);
+  bool OnWillRead(int request_id, net::IOBuffer** buf, int* buf_size,
+                  int min_size);
 
   // Passes the buffer to the download file writer.
   bool OnReadCompleted(int request_id, int* bytes_read);
@@ -50,7 +51,7 @@ class SaveFileResourceHandler : public ResourceHandler {
   int save_id_;
   int render_process_id_;
   int render_view_id_;
-  char* read_buffer_;
+  scoped_refptr<net::IOBuffer> read_buffer_;
   std::string content_disposition_;
   std::wstring url_;
   std::wstring final_url_;
diff --git a/chrome/browser/renderer_host/sync_resource_handler.cc b/chrome/browser/renderer_host/sync_resource_handler.cc
index aace1c1..a30f10f 100644
--- a/chrome/browser/renderer_host/sync_resource_handler.cc
+++ b/chrome/browser/renderer_host/sync_resource_handler.cc
@@ -8,7 +8,8 @@ SyncResourceHandler::SyncResourceHandler(
     ResourceDispatcherHost::Receiver* receiver,
     const GURL& url,
     IPC::Message* result_message)
-    : receiver_(receiver),
+    : read_buffer_(new net::IOBuffer(kReadBufSize)),
+      receiver_(receiver),
       result_message_(result_message) {
   result_.final_url = url;
   result_.filter_policy = FilterPolicy::DONT_FILTER;
@@ -29,10 +30,10 @@ bool SyncResourceHandler::OnResponseStarted(int request_id,
   return true;
 }
 
-bool SyncResourceHandler::OnWillRead(int request_id,
-                                     char** buf, int* buf_size, int min_size) {
+bool SyncResourceHandler::OnWillRead(int request_id, net::IOBuffer** buf,
+                                     int* buf_size, int min_size) {
   DCHECK(min_size == -1);
-  *buf = read_buffer_;
+  *buf = read_buffer_.get();
   *buf_size = kReadBufSize;
   return true;
 }
@@ -40,7 +41,7 @@ bool SyncResourceHandler::OnWillRead(int request_id,
 bool SyncResourceHandler::OnReadCompleted(int request_id, int* bytes_read) {
   if (!*bytes_read)
     return true;
-  result_.data.append(read_buffer_, *bytes_read);
+  result_.data.append(read_buffer_->data(), *bytes_read);
   return true;
 }
 
diff --git a/chrome/browser/renderer_host/sync_resource_handler.h b/chrome/browser/renderer_host/sync_resource_handler.h
index 81a6078..012ab9e 100644
--- a/chrome/browser/renderer_host/sync_resource_handler.h
+++ b/chrome/browser/renderer_host/sync_resource_handler.h
@@ -7,6 +7,7 @@
 
 #include "chrome/browser/renderer_host/resource_dispatcher_host.h"
 #include "chrome/browser/renderer_host/resource_handler.h"
+#include "net/base/io_buffer.h"
 
 // Used to complete a synchronous resource request in response to resource load
 // events from the resource dispatcher host.
@@ -18,13 +19,14 @@ class SyncResourceHandler : public ResourceHandler {
 
   bool OnRequestRedirected(int request_id, const GURL& new_url);
   bool OnResponseStarted(int request_id, ResourceResponse* response);
-  bool OnWillRead(int request_id, char** buf, int* buf_size, int min_size);
+  bool OnWillRead(int request_id, net::IOBuffer** buf, int* buf_size,
+                  int min_size);
   bool OnReadCompleted(int request_id, int* bytes_read);
   bool OnResponseCompleted(int request_id, const URLRequestStatus& status);
 
  private:
   enum { kReadBufSize = 3840 };
-  char read_buffer_[kReadBufSize];
+  scoped_refptr<net::IOBuffer> read_buffer_;
 
   ViewHostMsg_SyncLoad_Result result_;
   ResourceDispatcherHost::Receiver* receiver_;