diff options
| author | amit@chromium.org <amit@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2010-08-26 21:27:07 +0000 |
|---|---|---|
| committer | amit@chromium.org <amit@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2010-08-26 21:27:07 +0000 |
| commit | a344237fd545ece5ea0698fad624881dd54dde6e (patch) | |
| tree | 25754f706532bc67b28a0499480456f0bf6a4fa6 /chrome_frame/urlmon_url_request.cc | |
| parent | 36ead95893d4d2a4430dd0e73f3d2572d9c0e168 (diff) | |
| download | chromium_src-a344237fd545ece5ea0698fad624881dd54dde6e.zip chromium_src-a344237fd545ece5ea0698fad624881dd54dde6e.tar.gz chromium_src-a344237fd545ece5ea0698fad624881dd54dde6e.tar.bz2 | |
Fix a crash when delegate_ goes away in ReadStream
Other callbacks can fire in the context of ReadStream and
OnStopBinding might happen in that context. In this case
the delegate_ is cleaned up and this results in a crash
when ReadStream returns.
BUG=53460
TEST=none
Review URL: http://codereview.chromium.org/3159045
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@57581 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'chrome_frame/urlmon_url_request.cc')
| -rw-r--r-- | chrome_frame/urlmon_url_request.cc | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/chrome_frame/urlmon_url_request.cc b/chrome_frame/urlmon_url_request.cc index 08f44ff..26713a8 100644 --- a/chrome_frame/urlmon_url_request.cc +++ b/chrome_frame/urlmon_url_request.cc @@ -221,7 +221,9 @@ size_t UrlmonUrlRequest::SendDataToDelegate(size_t bytes_to_read) { if (bytes_copied) { ++calling_delegate_; DCHECK_NE(id(), -1); - delegate_->OnReadComplete(id(), read_data); + // The delegate can go away in the middle of ReadStream + if (delegate_) + delegate_->OnReadComplete(id(), read_data); --calling_delegate_; } } else { |