Fix a potential crash by clearing callback_ before running it....

webkit/glue/resource_fetcher.h

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
 // A wrapper around ResourceHandle and ResourceHandleClient that simplifies
 // the download of an HTTP object.  The interface is modeled after URLFetcher
 // in the /chrome/browser.
 //
 // ResourceFetcher::Delegate::OnURLFetchComplete will be called async after
 // the ResourceFetcher object is created.
@@ skipping 57 matching lines @@
   virtual void didFinishLoading(
       WebKit::WebURLLoader* loader, double finishTime);
   virtual void didFail(
       WebKit::WebURLLoader* loader, const WebKit::WebURLError& error);
 
   scoped_ptr<WebKit::WebURLLoader> loader_;
 
   // URL we're fetching
   GURL url_;
 
-  // Callback when we're done
-  scoped_ptr<Callback> callback_;
-
   // A copy of the original resource response
   WebKit::WebURLResponse response_;
 
   // Set to true once the request is compelte.
   bool completed_;
 
  private:
   // Start the actual download.
   void Start(WebKit::WebFrame* frame);
 
+  void RunCallback(const WebKit::WebURLResponse& response,
+                   const std::string& data);
+
+  // Callback when we're done
+  scoped_ptr<Callback> callback_;
+
   // Buffer to hold the content from the server.
   std::string data_;
 
   // Buffer to hold metadata from the cache.
   std::string metadata_;
 };
 
 /////////////////////////////////////////////////////////////////////////////
 // A resource fetcher with a timeout
 class ResourceFetcherWithTimeout : public ResourceFetcher {
  public:
   ResourceFetcherWithTimeout(const GURL& url, WebKit::WebFrame* frame,
                              int timeout_secs, Callback* c);
   virtual ~ResourceFetcherWithTimeout();
 
  private:
   // Callback for timer that limits how long we wait for the alternate error
   // page server.  If this timer fires and the request hasn't completed, we
   // kill the request.
   void TimeoutFired();
 
   // Limit how long we wait for the alternate error page server.
   base::OneShotTimer<ResourceFetcherWithTimeout> timeout_timer_;
 };
 
 }  // namespace webkit_glue
 
 #endif  // WEBKIT_GLUE_RESOURCE_FETCHER_H_