Fixes bug in IconManager where it was possible for callback to be

invoked with a deleted pointer. We never hit this as none of the
callers use the SkBitmap supplied to the callback. I was tempted to
nuke the SkBitmap from the callback, but seems useful.

BUG=1372146
TEST=none

Review URL: http://codereview.chromium.org/2438

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@2081 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 4 insertions, 3 deletions

diff --git a/chrome/browser/icon_manager.cc b/chrome/browser/icon_manager.cc
index da71179..8107877 100644
--- a/chrome/browser/icon_manager.cc
+++ b/chrome/browser/icon_manager.cc
@@ -61,13 +61,13 @@ bool IconManager::OnSkBitmapLoaded(IconLoader* source, SkBitmap* result) {
   ClientRequests::iterator rit = requests_.find(source);
   if (rit == requests_.end()) {
     NOTREACHED();
-    return false;
+    return false;  // Return false to indicate result should be deleted.
   }
 
   ClientRequest client_request = rit->second;
   if (client_request.request->canceled()) {
     requests_.erase(rit);
-    return true;
+    return false;  // Return false to indicate result should be deleted.
   }
 
   CacheKey key(client_request.file_name, client_request.size);
@@ -75,6 +75,7 @@ bool IconManager::OnSkBitmapLoaded(IconLoader* source, SkBitmap* result) {
   if (it != icon_cache_.end()) {
     it->second->swap(*result);
     delete result;
+    result = it->second;
   } else {
     icon_cache_[key] = result;
   }
@@ -85,7 +86,7 @@ bool IconManager::OnSkBitmapLoaded(IconLoader* source, SkBitmap* result) {
                                                      result));
   requests_.erase(rit);
 
-  return true;
+  return true;  // Indicates we took ownership of result.
 }
 
 bool IconManager::OnHICONLoaded(IconLoader* source,