Give QuickTime the plugin stream data in writeable memory as it modifies it.

content/child/npapi/plugin_url_fetcher.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/child/npapi/plugin_url_fetcher.h"
 
 #include "content/child/child_thread.h"
 #include "content/child/npapi/webplugin.h"
 #include "content/child/npapi/plugin_host.h"
 #include "content/child/npapi/plugin_instance.h"
@@ skipping 62 matching lines @@
                                    const GURL& url,
                                    const GURL& first_party_for_cookies,
                                    const std::string& method,
                                    const char* buf,
                                    unsigned int len,
                                    const GURL& referrer,
                                    bool notify_redirects,
                                    bool is_plugin_src_load,
                                    int origin_pid,
                                    int render_frame_id,
-                                   unsigned long resource_id)
+                                   unsigned long resource_id,
+                                   bool copy_stream_data)
     : plugin_stream_(plugin_stream),
       url_(url),
       first_party_for_cookies_(first_party_for_cookies),
       method_(method),
       referrer_(referrer),
       notify_redirects_(notify_redirects),
       is_plugin_src_load_(is_plugin_src_load),
       resource_id_(resource_id),
+      copy_stream_data_(copy_stream_data),
       data_offset_(0),
       pending_failure_notification_(false) {
   webkit_glue::ResourceLoaderBridge::RequestInfo request_info;
   request_info.method = method;
   request_info.url = url;
   request_info.first_party_for_cookies = first_party_for_cookies;
   request_info.referrer = referrer;
   request_info.load_flags = net::LOAD_NORMAL;
   request_info.requestor_pid = origin_pid;
   request_info.request_type = ResourceType::OBJECT;
@@ skipping 192 matching lines @@
 }
 
 void PluginURLFetcher::OnReceivedData(const char* data,
                                       int data_length,
                                       int encoded_data_length) {
   if (multipart_delegate_) {
     multipart_delegate_->OnReceivedData(data, data_length, encoded_data_length);
   } else {
     int64 offset = data_offset_;
     data_offset_ += data_length;
-    plugin_stream_->DidReceiveData(data, data_length, offset);
+
+    if (copy_stream_data_) {
+      // QuickTime writes to this memory, and since we got it from
+      // ResourceDispatcher it's not mapped for write access in this process.
+      // http://crbug.com/308466.
+      char* data_copy = new char[data_length];

[ananta, 2014/01/17 18:51:02]

scoped_ptr?

[jam, 2014/01/17 19:09:17]

Done.

+      memcpy(data_copy, data, data_length);
+      plugin_stream_->DidReceiveData(data_copy, data_length, offset);
+      delete [] data_copy;
+    } else {
+      plugin_stream_->DidReceiveData(data, data_length, offset);
+    }
     // DANGER: this instance may be deleted at this point.
   }
 }
 
 void PluginURLFetcher::OnCompletedRequest(
     int error_code,
     bool was_ignored_by_handler,
     const std::string& security_info,
     const base::TimeTicks& completion_time) {
   if (multipart_delegate_) {
     multipart_delegate_->OnCompletedRequest();
     multipart_delegate_.reset();
   }
 
   if (error_code == net::OK) {
     plugin_stream_->DidFinishLoading(resource_id_);
   } else {
     plugin_stream_->DidFail(resource_id_);
   }
 }
 
 }  // namespace content