diff options
| author | jam <jam@chromium.org> | 2015-05-19 15:23:52 -0700 |
|---|---|---|
| committer | Commit bot <commit-bot@chromium.org> | 2015-05-19 22:24:38 +0000 |
| commit | 05f187772cffebd3caed3936e314c7ce92ba716b (patch) | |
| tree | f3e20dd77de7ed5a60cb34d56372f1c1695dd6d9 /mojo/services | |
| parent | 7dd0529036b94a81b1812ea7f98afec89528975b (diff) | |
| download | chromium_src-05f187772cffebd3caed3936e314c7ce92ba716b.zip chromium_src-05f187772cffebd3caed3936e314c7ce92ba716b.tar.gz chromium_src-05f187772cffebd3caed3936e314c7ce92ba716b.tar.bz2 | |
Fix crash in network_service.
The problem is that |response| was passed in the Bind call before the body was taken out. I saw this because of null dereference on Windows. The order of evaluation is undefined, which is why it worked on Linux.
Review URL: https://codereview.chromium.org/1138443004
Cr-Commit-Position: refs/heads/master@{#330634}
Diffstat (limited to 'mojo/services')
| -rw-r--r-- | mojo/services/network/http_connection_impl.cc | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/mojo/services/network/http_connection_impl.cc b/mojo/services/network/http_connection_impl.cc index be306cd..0831d1d 100644 --- a/mojo/services/network/http_connection_impl.cc +++ b/mojo/services/network/http_connection_impl.cc @@ -141,8 +141,9 @@ void HttpConnectionImpl::OnReceivedHttpRequest( if (response->body.is_valid()) { SimpleDataPipeReader* reader = new SimpleDataPipeReader; response_body_readers_.insert(reader); + ScopedDataPipeConsumerHandle body = response->body.Pass(); reader->Start( - response->body.Pass(), + body.Pass(), base::Bind(&HttpConnectionImpl::OnFinishedReadingResponseBody, base::Unretained(this), base::Passed(&response))); } else { |