From cf2ef75e53c54e8d4ffdf4af345ea4050205f7a4 Mon Sep 17 00:00:00 2001 From: "sky@google.com" Date: Thu, 11 Sep 2008 21:19:29 +0000 Subject: Fixes bug in IconManager where it was possible for callback to be invoked with a deleted pointer. We never hit this as none of the callers use the SkBitmap supplied to the callback. I was tempted to nuke the SkBitmap from the callback, but seems useful. BUG=1372146 TEST=none Review URL: http://codereview.chromium.org/2438 git-svn-id: svn://svn.chromium.org/chrome/trunk/src@2081 0039d316-1c4b-4281-b951-d872f2087c98 --- chrome/browser/icon_manager.cc | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'chrome') diff --git a/chrome/browser/icon_manager.cc b/chrome/browser/icon_manager.cc index da71179..8107877 100644 --- a/chrome/browser/icon_manager.cc +++ b/chrome/browser/icon_manager.cc @@ -61,13 +61,13 @@ bool IconManager::OnSkBitmapLoaded(IconLoader* source, SkBitmap* result) { ClientRequests::iterator rit = requests_.find(source); if (rit == requests_.end()) { NOTREACHED(); - return false; + return false; // Return false to indicate result should be deleted. } ClientRequest client_request = rit->second; if (client_request.request->canceled()) { requests_.erase(rit); - return true; + return false; // Return false to indicate result should be deleted. } CacheKey key(client_request.file_name, client_request.size); @@ -75,6 +75,7 @@ bool IconManager::OnSkBitmapLoaded(IconLoader* source, SkBitmap* result) { if (it != icon_cache_.end()) { it->second->swap(*result); delete result; + result = it->second; } else { icon_cache_[key] = result; } @@ -85,7 +86,7 @@ bool IconManager::OnSkBitmapLoaded(IconLoader* source, SkBitmap* result) { result)); requests_.erase(rit); - return true; + return true; // Indicates we took ownership of result. } bool IconManager::OnHICONLoaded(IconLoader* source, -- cgit v1.1