Fix a crash when the content type of a multipart request

webkit/glue/multipart_response_delegate.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/glue/multipart_response_delegate.h"
 
 #include "base/logging.h"
 #include "base/string_util.h"
 #include "net/base/net_util.h"
 #include "net/http/http_util.h"
@@ skipping 107 matching lines @@
       processing_headers_ = false;
     } else {
       // Get more data before trying again.
       return;
     }
   }
   DCHECK(!processing_headers_);
 
   size_t boundary_pos;
   while ((boundary_pos = FindBoundary()) != std::string::npos) {
-    if (boundary_pos > 0) {
+    if (boundary_pos > 0 && client_) {
       // Send the last data chunk.
       client_->didReceiveData(loader_,
                               data_.data(),
                               static_cast<int>(boundary_pos));
     }
     size_t boundary_end_pos = boundary_pos + boundary_.length();
     if (boundary_end_pos < data_.length() && '-' == data_[boundary_end_pos]) {
       // This was the last boundary so we can stop processing.
       stop_sending_ = true;
       data_.clear();
@@ skipping 12 matching lines @@
   }
 
   // At this point, we should send over any data we have, but keep enough data
   // buffered to handle a boundary that may have been truncated.
   if (!processing_headers_ && data_.length() > boundary_.length()) {
     // If the last character is a new line character, go ahead and just send
     // everything we have buffered.  This matches an optimization in Gecko.
     int send_length = data_.length() - boundary_.length();
     if (data_[data_.length() - 1] == '\n')
       send_length = data_.length();
-    client_->didReceiveData(loader_, data_.data(), send_length);
+    if (client_)
+      client_->didReceiveData(loader_, data_.data(), send_length);
     data_ = data_.substr(send_length);
   }
 }
 
 void MultipartResponseDelegate::OnCompletedRequest() {
   // If we have any pending data and we're not in a header, go ahead and send
   // it to WebCore.
-  if (!processing_headers_ && !data_.empty()) {
+  if (!processing_headers_ && !data_.empty() && !stop_sending_ && client_) {
     client_->didReceiveData(loader_,
                             data_.data(),
                             static_cast<int>(data_.length()));
   }
 }
 
 int MultipartResponseDelegate::PushOverLine(const std::string& data,
                                             size_t pos) {
   int offset = 0;
   if (pos < data.length() && (data[pos] == '\r' || data[pos] == '\n')) {
@@ skipping 60 matching lines @@
                                   WebString::fromUTF8(value));
     }
   }
   // To avoid recording every multipart load as a separate visit in
   // the history database, we want to keep track of whether the response
   // is part of a multipart payload.  We do want to record the first visit,
   // so we only set isMultipartPayload to true after the first visit.
   response.setIsMultipartPayload(has_sent_first_response_);
   has_sent_first_response_ = true;
   // Send the response!
-  client_->didReceiveResponse(loader_, response);
+  if (client_)
+    client_->didReceiveResponse(loader_, response);
 
   return true;
 }
 
 // Boundaries are supposed to be preceeded with --, but it looks like gecko
 // doesn't require the dashes to exist.  See nsMultiMixedConv::FindToken.
 size_t MultipartResponseDelegate::FindBoundary() {
   size_t boundary_pos = data_.find(boundary_);
   if (boundary_pos != std::string::npos) {
     // Back up over -- for backwards compat
@@ skipping 90 matching lines @@
                            byte_range_upper_bound_characters);
 
   if (!StringToInt(byte_range_lower_bound, content_range_lower_bound))
     return false;
   if (!StringToInt(byte_range_upper_bound, content_range_upper_bound))
     return false;
   return true;
 }
 
 }  // namespace webkit_glue