fix a semi-rare crash in multibuffers

media/blink/resource_multibuffer_data_provider.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "media/blink/resource_multibuffer_data_provider.h"
 
 #include <stddef.h>
 #include <utility>
 
 #include "base/bind.h"
@@ skipping 240 matching lines @@
                                 max_enum);  // PRESUBMIT_IGNORE_UMA_MAX
     }
 
     reasons >>= 1;
     ++shift;
   }
 
   // Expected content length can be |kPositionNotSpecified|, in that case
   // |content_length_| is not specified and this is a streaming response.
   int64_t content_length = response.expectedContentLength();
+  bool end_of_file = false;
 
   // We make a strong assumption that when we reach here we have either
   // received a response from HTTP/HTTPS protocol or the request was
   // successful (in particular range request). So we only verify the partial
   // response for HTTP and HTTPS protocol.
   if (destination_url_data->url().SchemeIsHTTPOrHTTPS()) {
     bool partial_response = (response.httpStatusCode() == kHttpPartialContent);
     bool ok_response = (response.httpStatusCode() == kHttpOK);
 
     // Check to see whether the server supports byte ranges.
     std::string accept_ranges =
         response.httpHeaderField("Accept-Ranges").utf8();
     if (accept_ranges.find("bytes") != std::string::npos)
       destination_url_data->set_range_supported();
 
     // If we have verified the partial response and it is correct.
     // It's also possible for a server to support range requests
     // without advertising "Accept-Ranges: bytes".
     if (partial_response &&
         VerifyPartialResponse(response, destination_url_data)) {
       destination_url_data->set_range_supported();
     } else if (ok_response && pos_ == 0) {
       // We accept a 200 response for a Range:0- request, trusting the
       // Accept-Ranges header, because Apache thinks that's a reasonable thing
       // to return.
       destination_url_data->set_length(content_length);
     } else if (response.httpStatusCode() == kHttpRangeNotSatisfiable) {
+      // Unsatisfiable range
       // Really, we should never request a range that doesn't exist, but
       // if we do, let's handle it in a sane way.
-      // Unsatisfiable range
-      fifo_.push_back(DataBuffer::CreateEOSBuffer());
-      destination_url_data->multibuffer()->OnDataProviderEvent(this);
-      return;
+      // Note, we can't just call OnDataProviderEvent() here, because
+      // url_data_ hasn't been updated to the final destination yet.
+      end_of_file = true;
     } else {
       active_loader_ = nullptr;
       destination_url_data->Fail();
       return;  // "this" may be deleted now.
     }
   } else {
     destination_url_data->set_range_supported();
     if (content_length != kPositionNotSpecified) {
       destination_url_data->set_length(content_length + byte_pos());
     }
@@ skipping 26 matching lines @@
 
   // This test is vital for security!
   const GURL& original_url = response.wasFetchedViaServiceWorker()
                                  ? response.originalURLViaServiceWorker()
                                  : response.url();
   if (!url_data_->ValidateDataOrigin(original_url.GetOrigin())) {
     active_loader_ = nullptr;
     url_data_->Fail();
     return;  // "this" may be deleted now.
   }
+
+  if (end_of_file) {
+    fifo_.push_back(DataBuffer::CreateEOSBuffer());
+    url_data_->multibuffer()->OnDataProviderEvent(this);
+  }
 }
 
 void ResourceMultiBufferDataProvider::didReceiveData(WebURLLoader* loader,
                                                      const char* data,
                                                      int data_length,
                                                      int encoded_data_length) {
   DVLOG(1) << "didReceiveData: " << data_length << " bytes";
   DCHECK(!Available());
   DCHECK(active_loader_);
   DCHECK_GT(data_length, 0);
@@ skipping 172 matching lines @@
   }
 
   if (byte_pos() != first_byte_position) {
     return false;
   }
 
   return true;
 }
 
 }  // namespace media