Fix a browser crash when the URLRequestChromeJob goes away

from the NotifyReadComplete notification.

BUG=7485

Review URL: http://codereview.chromium.org/20162

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@9541 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 4 insertions, 2 deletions

diff --git a/chrome/browser/dom_ui/chrome_url_data_manager.cc b/chrome/browser/dom_ui/chrome_url_data_manager.cc
index b73b19a..89cfe89 100644
--- a/chrome/browser/dom_ui/chrome_url_data_manager.cc
+++ b/chrome/browser/dom_ui/chrome_url_data_manager.cc
@@ -231,7 +231,9 @@ void ChromeURLDataManager::DataAvailable(
   // Forward this data on to the pending URLRequest, if it exists.
   PendingRequestMap::iterator i = pending_requests_.find(request_id);
   if (i != pending_requests_.end()) {
-    URLRequestChromeJob* job = i->second;
+    // We acquire a reference to the job so that it doesn't disappear under the
+    // feet of any method invoked here (we could trigger a callback).
+    scoped_refptr<URLRequestChromeJob> job = i->second;
     pending_requests_.erase(i);
     job->DataAvailable(bytes);
   }
@@ -291,8 +293,8 @@ void URLRequestChromeJob::DataAvailable(RefCountedBytes* bytes) {
     int bytes_read;
     if (pending_buf_.get()) {
       CompleteRead(pending_buf_, pending_buf_size_, &bytes_read);
-      NotifyReadComplete(bytes_read);
       pending_buf_ = NULL;
+      NotifyReadComplete(bytes_read);
     }
   } else {
     // The request failed.