Fix a memory leak in ChromeFrame which is caused by leaking the urlmon transaction objects.

This occurs because we return INET_E_TERMINATED_BIND from our IBindStatusCallback::OnDataAvailable
implementation to keep the transaction around, which leaks.

To ensure that it is freed correctly we issue a dummy BindToObject call on the moniker
which fails and cleans up the transaction.

Fixes bug http://code.google.com/p/chromium/issues/detail?id=57549

Bug=57549

Review URL: http://codereview.chromium.org/3570017

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@61997 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 8 insertions, 0 deletions

diff --git a/chrome_frame/urlmon_url_request_private.h b/chrome_frame/urlmon_url_request_private.h
index 9f6d823..2d9887c 100644
--- a/chrome_frame/urlmon_url_request_private.h
+++ b/chrome_frame/urlmon_url_request_private.h
@@ -125,6 +125,7 @@ class UrlmonUrlRequest
 
   HRESULT StartAsyncDownload();
   void NotifyDelegateAndDie();
+  void TerminateTransaction();
   static net::Error HresultToNetError(HRESULT hr);
 
  private:
@@ -241,6 +242,13 @@ class UrlmonUrlRequest
   bool pending_;
   scoped_ptr<TerminateBindCallback> terminate_bind_callback_;
   std::string response_headers_;
+  // Set to true when Chrome issues a read request for the URL.
+  bool read_received_from_chrome_;
+  // Set to true if the Urlmon transaction object needs to be cleaned up
+  // when this object is destroyed. Happens if we return
+  // INET_E_TERMINATE_BIND from OnDataAvailable in the last data notification.
+  bool cleanup_transaction_;
+
   DISALLOW_COPY_AND_ASSIGN(UrlmonUrlRequest);
 };