Give QuickTime the plugin stream data in writeable memory as it modifies it.

content/child/npapi/plugin_url_fetcher.cc

Index: content/child/npapi/plugin_url_fetcher.cc
===================================================================
--- content/child/npapi/plugin_url_fetcher.cc	(revision 245386)
+++ content/child/npapi/plugin_url_fetcher.cc	(working copy)
@@ -80,7 +80,8 @@
                                    bool is_plugin_src_load,
                                    int origin_pid,
                                    int render_frame_id,
-                                   unsigned long resource_id)
+                                   unsigned long resource_id,
+                                   bool copy_stream_data)
     : plugin_stream_(plugin_stream),
       url_(url),
       first_party_for_cookies_(first_party_for_cookies),
@@ -89,6 +90,7 @@
       notify_redirects_(notify_redirects),
       is_plugin_src_load_(is_plugin_src_load),
       resource_id_(resource_id),
+      copy_stream_data_(copy_stream_data),
       data_offset_(0),
       pending_failure_notification_(false) {
   webkit_glue::ResourceLoaderBridge::RequestInfo request_info;
@@ -301,7 +303,18 @@
   } else {
     int64 offset = data_offset_;
     data_offset_ += data_length;
-    plugin_stream_->DidReceiveData(data, data_length, offset);
+
+    if (copy_stream_data_) {
+      // QuickTime writes to this memory, and since we got it from
+      // ResourceDispatcher it's not mapped for write access in this process.
+      // http://crbug.com/308466.
+      char* data_copy = new char[data_length];

[ananta, 2014/01/17 18:51:02]

scoped_ptr?

[jam, 2014/01/17 19:09:17]

Done.

+      memcpy(data_copy, data, data_length);
+      plugin_stream_->DidReceiveData(data_copy, data_length, offset);
+      delete [] data_copy;
+    } else {
+      plugin_stream_->DidReceiveData(data, data_length, offset);
+    }
     // DANGER: this instance may be deleted at this point.
   }
 }