Fix a browser crash when the async resource handler keeps an...

chrome/browser/renderer_host/async_resource_handler.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/renderer_host/async_resource_handler.h"
 
 #include "base/process.h"
 #include "base/shared_memory.h"
 #include "chrome/common/render_messages.h"
 #include "net/base/io_buffer.h"
@@ skipping 85 matching lines @@
     return true;
   }
 
   base::SharedMemoryHandle handle;
   if (!read_buffer_->shared_memory()->GiveToProcess(render_process_, &handle)) {
     // We wrongfully incremented the pending data count. Fake an ACK message
     // to fix this. We can't move this call above the WillSendData because
     // it's killing our read_buffer_, and we don't want that when we pause
     // the request.
     rdh_->OnDataReceivedACK(render_process_host_id_, request_id);
+    // We just unmapped the memory.
+    read_buffer_ = NULL;
     return false;
   }
   // We just unmapped the memory.
   read_buffer_ = NULL;
 
   receiver_->Send(new ViewMsg_Resource_DataReceived(
       routing_id_, request_id, handle, *bytes_read));
 
   return true;
 }
 
 bool AsyncResourceHandler::OnResponseCompleted(int request_id,
                                                const URLRequestStatus& status) {
   receiver_->Send(new ViewMsg_Resource_RequestComplete(routing_id_,
                                                        request_id, status));
 
   // If we still have a read buffer, then see about caching it for later...
   if (spare_read_buffer_) {
     read_buffer_ = NULL;
   } else if (read_buffer_.get()) {
     read_buffer_.swap(&spare_read_buffer_);
   }
   return true;
 }
 
 // static
 void AsyncResourceHandler::GlobalCleanup() {
-  spare_read_buffer_ = NULL;
+  if (spare_read_buffer_) {
+    spare_read_buffer_->Release();
+    spare_read_buffer_ = NULL;
+  }
 }