Don't send a reference to a string that goes out of scope.

chrome/common/net/url_fetcher.cc

Index: chrome/common/net/url_fetcher.cc
diff --git a/chrome/common/net/url_fetcher.cc b/chrome/common/net/url_fetcher.cc
index 8674b4a1a17276f2bcff54e554855e35635b488c..5d86ab86a4fce4774f203311080f3a728cba2857 100644
--- a/chrome/common/net/url_fetcher.cc
+++ b/chrome/common/net/url_fetcher.cc
@@ -458,14 +458,15 @@ void URLFetcher::Delegate::OnURLFetchComplete(
 
 // TODO(skerner): This default implementation will be removed, and the
 // method made pure virtual, once all users of URLFetcher are updated
-// to not expect response data as a string argument.
+// to not expect response data as a string argument.  Once this is removed,
+// the method URLFetcher::GetResponseStringRef() can be removed as well.
+// crbug.com/83592 tracks this.
 void URLFetcher::Delegate::OnURLFetchComplete(const URLFetcher* source) {
   // A delegate that did not override this method is using the old
   // parameter list to OnURLFetchComplete(). If a user asked to save
   // the response to a file, they must use the new parameter list,
   // in which case we can not get here.
-  std::string data;
-  CHECK(source->GetResponseAsString(&data));
+  CHECK(source->response_destination_ == STRING);
 
   // To avoid updating all callers, thunk to the old prototype for now.
   OnURLFetchComplete(source,
@@ -473,7 +474,7 @@ void URLFetcher::Delegate::OnURLFetchComplete(const URLFetcher* source) {
                      source->status(),
                      source->response_code(),
                      source->cookies(),
-                     data);
+                     source->GetResponseStringRef());
 }
 
 // static
@@ -978,6 +979,11 @@ bool URLFetcher::GetResponseAsString(std::string* out_response_string) const {
   return true;
 }
 
+const std::string& URLFetcher::GetResponseStringRef() const {
+  CHECK(response_destination_ == STRING);
+  return core_->data_;
+}
+
 bool URLFetcher::GetResponseAsFilePath(bool take_ownership,
                                        FilePath* out_response_path) const {
   if (response_destination_ != TEMP_FILE || !core_->temp_file_writer_.get())