Http cache: Make sure that the memory used to receive the...

net/http/http_cache.cc

Index: net/http/http_cache.cc
===================================================================
--- net/http/http_cache.cc	(revision 56971)
+++ net/http/http_cache.cc	(working copy)
@@ -63,10 +63,11 @@
 // This structure keeps track of work items that are attempting to create or
 // open cache entries or the backend itself.
 struct HttpCache::PendingOp {
-  PendingOp() : disk_entry(NULL), writer(NULL), callback(NULL) {}
+  PendingOp() : disk_entry(NULL), backend(NULL), writer(NULL), callback(NULL) {}
   ~PendingOp() {}
 
   disk_cache::Entry* disk_entry;
+  disk_cache::Backend* backend;
   WorkItem* writer;
   CompletionCallback* callback;  // BackendCallback.
   WorkItemList pending_queue;
@@ -143,8 +144,13 @@
   ~BackendCallback() {}
 
   virtual void RunWithParams(const Tuple1<int>& params) {
-    if (cache_)
+    if (cache_) {
       cache_->OnIOComplete(params.a, pending_op_);
+    } else {
+      // The callback was cancelled so we should delete the pending_op that
+      // was used with this callback.
+      delete pending_op_;
+    }
     delete this;
   }
 
@@ -243,7 +249,6 @@
                      NetLog* net_log,
                      BackendFactory* backend_factory)
     : backend_factory_(backend_factory),
-      temp_backend_(NULL),
       building_backend_(false),
       mode_(NORMAL),
       network_layer_(HttpNetworkLayer::CreateFactory(host_resolver,
@@ -256,7 +261,6 @@
 HttpCache::HttpCache(HttpNetworkSession* session,
                      BackendFactory* backend_factory)
     : backend_factory_(backend_factory),
-      temp_backend_(NULL),
       building_backend_(false),
       mode_(NORMAL),
       network_layer_(HttpNetworkLayer::CreateFactory(session)),
@@ -267,7 +271,6 @@
 HttpCache::HttpCache(HttpTransactionFactory* network_layer,
                      BackendFactory* backend_factory)
     : backend_factory_(backend_factory),
-      temp_backend_(NULL),
       building_backend_(false),
       mode_(NORMAL),
       network_layer_(network_layer),
@@ -297,19 +300,24 @@
     // though they are waiting for a callback that will never fire.
     PendingOp* pending_op = pending_it->second;
     delete pending_op->writer;
+    bool delete_pending_op = true;
     if (building_backend_) {
       // If we don't have a backend, when its construction finishes it will
       // deliver the callbacks.
       BackendCallback* callback =
           static_cast<BackendCallback*>(pending_op->callback);
-      if (callback)
+      if (callback) {
+        // The callback will delete the pending operation.
         callback->Cancel();
+        delete_pending_op = false;
+      }
     } else {
       delete pending_op->callback;
     }
 
     STLDeleteElements(&pending_op->pending_queue);
-    delete pending_op;
+    if (delete_pending_op)
+      delete pending_op;
   }
 }
 
@@ -417,7 +425,7 @@
   BackendCallback* my_callback = new BackendCallback(this, pending_op);
   pending_op->callback = my_callback;
 
-  int rv = backend_factory_->CreateBackend(&temp_backend_, my_callback);
+  int rv = backend_factory_->CreateBackend(&pending_op->backend, my_callback);
   if (rv != ERR_IO_PENDING) {
     pending_op->writer->ClearCallback();
     my_callback->Run(rv);
@@ -1016,6 +1024,7 @@
 
   // We don't need the callback anymore.
   pending_op->callback = NULL;
+  disk_cache::Backend* backend = pending_op->backend;
 
   if (backend_factory_.get()) {
     // We may end up calling OnBackendCreated multiple times if we have pending
@@ -1023,7 +1032,7 @@
     // and the last call clears building_backend_.
     backend_factory_.reset();  // Reclaim memory.
     if (result == OK)
-      disk_cache_.reset(temp_backend_);
+      disk_cache_.reset(backend);
   }
 
   if (!pending_op->pending_queue.empty()) {
@@ -1045,7 +1054,7 @@
   }
 
   // The cache may be gone when we return from the callback.
-  if (!item->DoCallback(result, temp_backend_))
+  if (!item->DoCallback(result, backend))
     item->NotifyTransaction(result, NULL);
 }