Handle CBF_SMBITMAP in the async version of the IPC.

chrome/browser/renderer_host/resource_message_filter.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/renderer_host/resource_message_filter.h"
 
 #include "app/clipboard/clipboard.h"
 #include "base/callback.h"
 #include "base/command_line.h"
 #include "base/file_util.h"
@@ skipping 855 matching lines @@
       new WriteClipboardTask(long_living_objects));
 }
 
 void ResourceMessageFilter::OnClipboardWriteObjectsAsync(
     const Clipboard::ObjectMap& objects) {
   // We cannot write directly from the IO thread, and cannot service the IPC
   // on the UI thread. We'll copy the relevant data and post a task to preform
   // the write on the UI thread.
   Clipboard::ObjectMap* long_living_objects = new Clipboard::ObjectMap(objects);
 
+  // This async message doesn't support shared-memory based bitmaps; they must
+  // be removed otherwise we might dereference a rubbish pointer.
+  long_living_objects->erase(Clipboard::CBF_SMBITMAP);
+
   ChromeThread::PostTask(
       ChromeThread::UI,
       FROM_HERE,
       new WriteClipboardTask(long_living_objects));
 }
 
 #if !defined(USE_X11)
 // On non-X11 platforms, clipboard actions can be performed on the IO thread.
 // On X11, since the clipboard is linked with GTK, we either have to do this
 // with GTK on the UI thread, or with Xlib on the BACKGROUND_X11 thread. In an
@@ skipping 584 matching lines @@
   dictionary_map.insert(
       std::make_pair(ExtensionMessageBundle::kExtensionIdKey, extension_id));
 
   ViewHostMsg_GetExtensionMessageBundle::WriteReplyParams(
       reply_msg, dictionary_map);
 
   ChromeThread::PostTask(
       ChromeThread::IO, FROM_HERE,
       NewRunnableMethod(this, &ResourceMessageFilter::Send, reply_msg));
 }