Merge 168150 - Break path whereby AssociatedURLLoader::~AssociatedURLLoader() is re-entered on top …

webkit/plugins/ppapi/ppb_url_loader_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/plugins/ppapi/ppb_url_loader_impl.h"
 
 #include "base/logging.h"
 #include "net/base/net_errors.h"
 #include "ppapi/c/pp_completion_callback.h"
 #include "ppapi/c/pp_errors.h"
@@ skipping 67 matching lines @@
       user_buffer_(NULL),
       user_buffer_size_(0),
       done_status_(PP_OK_COMPLETIONPENDING),
       is_streaming_to_file_(false),
       is_asynchronous_load_suspended_(false),
       has_universal_access_(false),
       status_callback_(NULL) {
 }
 
 PPB_URLLoader_Impl::~PPB_URLLoader_Impl() {
+  // There is a path whereby the destructor for the loader_ member can
+  // invoke InstanceWasDeleted() upon this PPB_URLLoader_Impl, thereby
+  // re-entering the scoped_ptr destructor with the same scoped_ptr object
+  // via loader_.reset(). Be sure that loader_ is first NULL then destroy
+  // the scoped_ptr. See http://crbug.com/159429.
+  scoped_ptr<WebKit::WebURLLoader> for_destruction_only(loader_.release());
 }
 
 PPB_URLLoader_API* PPB_URLLoader_Impl::AsPPB_URLLoader_API() {
   return this;
 }
 
 void PPB_URLLoader_Impl::InstanceWasDeleted() {
   Resource::InstanceWasDeleted();
   loader_.reset();
 }
@@ skipping 399 matching lines @@
 bool PPB_URLLoader_Impl::RecordDownloadProgress() const {
   return request_data_.record_download_progress;
 }
 
 bool PPB_URLLoader_Impl::RecordUploadProgress() const {
   return request_data_.record_upload_progress;
 }
 
 }  // namespace ppapi
 }  // namespace webkit