Stale user_buffer_ pointer in PPB_URLLoader_impl after disptaching a callback

webkit/plugins/ppapi/ppb_url_loader_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/plugins/ppapi/ppb_url_loader_impl.h"
 
 #include "base/logging.h"
 #include "net/base/net_errors.h"
 #include "ppapi/c/pp_completion_callback.h"
 #include "ppapi/c/pp_errors.h"
@@ skipping 372 matching lines @@
     loader_->setDefersLoading(defers_loading);
     is_asynchronous_load_suspended_ = defers_loading;
   }
 
   // TODO(brettw) bug 96770: We need a way to set the defers loading flag on
   // main document loads (when the loader_ is null).
 }
 
 void PPB_URLLoader_Impl::FinishLoading(int32_t done_status) {
   done_status_ = done_status;
+  user_buffer_ = NULL;
+  user_buffer_size_ = 0;
   // If the client hasn't called any function that takes a callback since
   // the initial call to Open, or called ReadResponseBody and got a
   // synchronous return, then the callback will be NULL.
   if (TrackedCallback::IsPending(pending_callback_))
     RunCallback(done_status_);
 }
 
 int32_t PPB_URLLoader_Impl::ValidateCallback(
     scoped_refptr<TrackedCallback> callback) {
   DCHECK(callback);
@@ skipping 14 matching lines @@
 
   pending_callback_ = callback;
 }
 
 void PPB_URLLoader_Impl::RunCallback(int32_t result) {
   // This may be null only when this is a main document loader.
   if (!pending_callback_.get()) {
     CHECK(main_document_loader_);
     return;
   }
+
+  // If |user_buffer_| was set as part of registering the callback, ensure
+  // it got cleared since the callback is now free to delete it.
+  DCHECK(!user_buffer_);
   TrackedCallback::ClearAndRun(&pending_callback_, result);
 }
 
 size_t PPB_URLLoader_Impl::FillUserBuffer() {
   DCHECK(user_buffer_);
   DCHECK(user_buffer_size_);
 
   size_t bytes_to_copy = std::min(buffer_.size(), user_buffer_size_);
   std::copy(buffer_.begin(), buffer_.begin() + bytes_to_copy, user_buffer_);
   buffer_.erase(buffer_.begin(), buffer_.begin() + bytes_to_copy);
@@ skipping 39 matching lines @@
 bool PPB_URLLoader_Impl::RecordDownloadProgress() const {
   return request_data_.record_download_progress;
 }
 
 bool PPB_URLLoader_Impl::RecordUploadProgress() const {
   return request_data_.record_upload_progress;
 }
 
 }  // namespace ppapi
 }  // namespace webkit