Fix a null pointer crasher.

webkit/appcache/appcache_response.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/appcache/appcache_response.h"
 
 #include "base/logging.h"
 #include "base/message_loop.h"
 #include "base/pickle.h"
 #include "base/string_util.h"
@@ skipping 196 matching lines @@
 
 void AppCacheResponseReader::SetReadRange(int offset, int length) {
   DCHECK(!IsReadPending() && !read_position_);
   range_offset_ = offset;
   range_length_ = length;
 }
 
 void AppCacheResponseReader::OnIOComplete(int result) {
   if (result >= 0) {
     if (info_buffer_.get()) {
-      // Allocate and deserialize the http info structure.
+      // Deserialize the http info structure.
       Pickle pickle(buffer_->data(), result);
+      scoped_ptr<net::HttpResponseInfo> info(new net::HttpResponseInfo);
       bool response_truncated = false;
-      info_buffer_->http_info.reset(new net::HttpResponseInfo);
-      info_buffer_->http_info->InitFromPickle(pickle, &response_truncated);
+      if (!info->InitFromPickle(pickle, &response_truncated)) {
+        InvokeUserCompletionCallback(net::ERR_FAILED);
+        return;
+      }
       DCHECK(!response_truncated);
+      info_buffer_->http_info.reset(info.release());
 
       // Also return the size of the response body
       DCHECK(entry_);
       info_buffer_->response_data_size =
           entry_->GetDataSize(kResponseContentIndex);
     } else {
       read_position_ += result;
     }
   }
   InvokeUserCompletionCallback(result);
@@ skipping 153 matching lines @@
   }
 
   if (info_buffer_)
     ContinueWriteInfo();
   else
     ContinueWriteData();
 }
 
 }  // namespace appcache