diff options
| author | ananta@chromium.org <ananta@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2010-02-02 01:06:25 +0000 |
|---|---|---|
| committer | ananta@chromium.org <ananta@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2010-02-02 01:06:25 +0000 |
| commit | a9c318eb057fbfd371860aacee6cfcdfc1022e8c (patch) | |
| tree | 8e4b837d3c17d4839b61cc7dd6be9528847345f9 /chrome_frame | |
| parent | f2d8c4217a9214d12385ca43e2b22fd691a4f47a (diff) | |
| download | chromium_src-a9c318eb057fbfd371860aacee6cfcdfc1022e8c.zip chromium_src-a9c318eb057fbfd371860aacee6cfcdfc1022e8c.tar.gz chromium_src-a9c318eb057fbfd371860aacee6cfcdfc1022e8c.tar.bz2 | |
The UrlmonUrlRequest::NotifyDelegateAndDie function can result in the UrlmonUrlRequest object getting
deleted in the same context. We need to make a copy of URLRequestStatus status before passing it off to
UrlmonUrlRequestManager::OnResponseEnd to ensure that we don't crash while accessing this object.
Review URL: http://codereview.chromium.org/567007
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@37778 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'chrome_frame')
| -rw-r--r-- | chrome_frame/urlmon_url_request.cc | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/chrome_frame/urlmon_url_request.cc b/chrome_frame/urlmon_url_request.cc index 42b1000..35e588e 100644 --- a/chrome_frame/urlmon_url_request.cc +++ b/chrome_frame/urlmon_url_request.cc @@ -828,7 +828,8 @@ void UrlmonUrlRequest::NotifyDelegateAndDie() { delegate_ = NULL; ReleaseBindings(); if (delegate) { - delegate->OnResponseEnd(id(), status_.get_result()); + URLRequestStatus result = status_.get_result(); + delegate->OnResponseEnd(id(), result); } } |