Fix potential leak

chrome/browser/ui/webui/chrome_url_data_manager.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/webui/chrome_url_data_manager.h"
 
 #include <vector>
 
 #include "base/i18n/rtl.h"
 #include "base/memory/ref_counted_memory.h"
@@ skipping 101 matching lines @@
     : source_name_(source_name),
       message_loop_(message_loop),
       backend_(NULL) {
 }
 
 ChromeURLDataManager::DataSource::~DataSource() {
 }
 
 void ChromeURLDataManager::DataSource::SendResponse(int request_id,
                                                     RefCountedMemory* bytes) {
+  // Take a ref-pointer on entry so byte->Release() will always get called.
+  scoped_refptr<RefCountedMemory> bytes_ptr(bytes);
   if (IsScheduledForDeletion(this)) {
     // We're scheduled for deletion. Servicing the request would result in
     // this->AddRef being invoked, even though the ref count is 0 and 'this' is
     // about to be deleted. If the AddRef were allowed through, when 'this' is
     // released it would be deleted again.
     //
     // This scenario occurs with DataSources that make history requests. Such
     // DataSources do a history query in |StartDataRequest| and the request is
     // live until the object is deleted (history requests don't up the ref
     // count). This means it's entirely possible for the DataSource to invoke
     // |SendResponse| between the time when there are no more refs and the time
     // when the object is deleted.
     return;
   }
   BrowserThread::PostTask(
       BrowserThread::IO, FROM_HERE,
       NewRunnableMethod(this, &DataSource::SendResponseOnIOThread,
-                        request_id, make_scoped_refptr(bytes)));
+                        request_id, bytes_ptr));
 }
 
 MessageLoop* ChromeURLDataManager::DataSource::MessageLoopForRequestPath(
     const std::string& path) const {
   return message_loop_;
 }
 
 bool ChromeURLDataManager::DataSource::ShouldReplaceExistingSource() const {
   return true;
 }
@@ skipping 18 matching lines @@
       base::i18n::IsRTL() ? "rtl" : "ltr");
 }
 
 void ChromeURLDataManager::DataSource::SendResponseOnIOThread(
     int request_id,
     scoped_refptr<RefCountedMemory> bytes) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
   if (backend_)
     backend_->DataAvailable(request_id, bytes);
 }