Prevent URLFetcher::AppendChunkedData from dereferencing NULL pointers.

net/base/chunked_upload_data_stream.cc

Index: net/base/chunked_upload_data_stream.cc
diff --git a/net/base/chunked_upload_data_stream.cc b/net/base/chunked_upload_data_stream.cc
index 2b9c4807c7a25996726c6db3cfc87abbea7d2587..7ddd9418dbc331fe5c9891ee5521773d404df638 100644
--- a/net/base/chunked_upload_data_stream.cc
+++ b/net/base/chunked_upload_data_stream.cc
@@ -10,17 +10,37 @@
 
 namespace net {
 
+ChunkedUploadDataStream::Writer::~Writer() {}
+
+bool ChunkedUploadDataStream::Writer::AppendData(const char* data,
+                                                 int data_len,
+                                                 bool is_done) {
+  if (!upload_data_stream_)

[mef, 2016/03/03 16:49:32]

Could this be racy if upload_data_stream_ is deleted on the network thread while
AppendData is running on ChunkedUpload thread?

[mmenke, 2016/03/03 17:04:45]

Neither of these classes is threadsafe - this is all happening on the network
thread.

[mef, 2016/03/08 17:19:22]

Ack, for some reason I thought that these are called on different thread. Thanks
for bearing with me!

[mmenke, 2016/03/09 17:27:15]

The URLFetcherCore runs on two threads, but all it does on the non-network-stack
thread is set state before the request starts.  Its methods that are meant to be
called after the request starts just post messages over to the network thread.

Everything else lives only on the network thread, with the exception of the
URLFetcher, which is used strictly on the consumers thread (Which may be the
network thread, or may not).

+    return false;
+  upload_data_stream_->AppendData(data, data_len, is_done);
+  return true;
+}
+
+ChunkedUploadDataStream::Writer::Writer(
+    base::WeakPtr<ChunkedUploadDataStream> upload_data_stream)
+    : upload_data_stream_(upload_data_stream) {}
+
 ChunkedUploadDataStream::ChunkedUploadDataStream(int64_t identifier)
     : UploadDataStream(true, identifier),
       read_index_(0),
       read_offset_(0),
       all_data_appended_(false),
-      read_buffer_len_(0) {
-}
+      read_buffer_len_(0),
+      weak_factory_(this) {}
 
 ChunkedUploadDataStream::~ChunkedUploadDataStream() {
 }
 
+scoped_ptr<ChunkedUploadDataStream::Writer>
+ChunkedUploadDataStream::CreateWriter() {
+  return make_scoped_ptr(new Writer(weak_factory_.GetWeakPtr()));
+}
+
 void ChunkedUploadDataStream::AppendData(
     const char* data, int data_len, bool is_done) {
   DCHECK(!all_data_appended_);