Relanding this change.

Fix a memory leak in ChromeFrame which is caused by leaking the urlmon transaction objects.
This occurs because we return INET_E_TERMINATED_BIND from our IBindStatusCallback::OnDataAvailable
implementation to keep the transaction around, which leaks.

To ensure that it is freed correctly we issue a dummy BindToObject call on the moniker
which fails and cleans up the transaction.

Fixes bug http://code.google.com/p/chromium/issues/detail?id=57549

Bug=57549

TBR=stoyan

Review URL: http://codereview.chromium.org/3539021

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@62028 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 10 insertions, 0 deletions

diff --git a/chrome_frame/urlmon_url_request_private.h b/chrome_frame/urlmon_url_request_private.h
index 9f6d823..cdd5419 100644
--- a/chrome_frame/urlmon_url_request_private.h
+++ b/chrome_frame/urlmon_url_request_private.h
@@ -125,6 +125,7 @@ class UrlmonUrlRequest
 
   HRESULT StartAsyncDownload();
   void NotifyDelegateAndDie();
+  void TerminateTransaction();
   static net::Error HresultToNetError(HRESULT hr);
 
  private:
@@ -241,6 +242,15 @@ class UrlmonUrlRequest
   bool pending_;
   scoped_ptr<TerminateBindCallback> terminate_bind_callback_;
   std::string response_headers_;
+  // Defaults to true and indicates whether we want to keep the original
+  // transaction alive when we receive the last data notification from
+  // urlmon.
+  bool is_expecting_download_;
+  // Set to true if the Urlmon transaction object needs to be cleaned up
+  // when this object is destroyed. Happens if we return
+  // INET_E_TERMINATE_BIND from OnDataAvailable in the last data notification.
+  bool cleanup_transaction_;
+
   DISALLOW_COPY_AND_ASSIGN(UrlmonUrlRequest);
 };