Fix a crash when the content type of a multipart request

changes to a content type that we ignore the load of.

For example, if the content type of a multipart request changes
from text/html to foo/bar, we would crash because we would
delete the multipart delegate while it was still on the stack.

BUG=47105

Review URL: http://codereview.chromium.org/2850023

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@50676 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 6 insertions, 4 deletions

diff --git a/webkit/glue/multipart_response_delegate.cc b/webkit/glue/multipart_response_delegate.cc
index 1b68064..d7c8c29 100644
--- a/webkit/glue/multipart_response_delegate.cc
+++ b/webkit/glue/multipart_response_delegate.cc
@@ -125,7 +125,7 @@ void MultipartResponseDelegate::OnReceivedData(const char* data,
 
   size_t boundary_pos;
   while ((boundary_pos = FindBoundary()) != std::string::npos) {
-    if (boundary_pos > 0) {
+    if (boundary_pos > 0 && client_) {
       // Send the last data chunk.
       client_->didReceiveData(loader_,
                               data_.data(),
@@ -158,7 +158,8 @@ void MultipartResponseDelegate::OnReceivedData(const char* data,
     int send_length = data_.length() - boundary_.length();
     if (data_[data_.length() - 1] == '\n')
       send_length = data_.length();
-    client_->didReceiveData(loader_, data_.data(), send_length);
+    if (client_)
+      client_->didReceiveData(loader_, data_.data(), send_length);
     data_ = data_.substr(send_length);
   }
 }
@@ -166,7 +167,7 @@ void MultipartResponseDelegate::OnReceivedData(const char* data,
 void MultipartResponseDelegate::OnCompletedRequest() {
   // If we have any pending data and we're not in a header, go ahead and send
   // it to WebCore.
-  if (!processing_headers_ && !data_.empty()) {
+  if (!processing_headers_ && !data_.empty() && !stop_sending_ && client_) {
     client_->didReceiveData(loader_,
                             data_.data(),
                             static_cast<int>(data_.length()));
@@ -247,7 +248,8 @@ bool MultipartResponseDelegate::ParseHeaders() {
   response.setIsMultipartPayload(has_sent_first_response_);
   has_sent_first_response_ = true;
   // Send the response!
-  client_->didReceiveResponse(loader_, response);
+  if (client_)
+    client_->didReceiveResponse(loader_, response);
 
   return true;
 }