[fsp] Fix crash when reading files.

chrome/browser/chromeos/file_system_provider/fileapi/file_stream_reader.cc

Index: chrome/browser/chromeos/file_system_provider/fileapi/file_stream_reader.cc
diff --git a/chrome/browser/chromeos/file_system_provider/fileapi/file_stream_reader.cc b/chrome/browser/chromeos/file_system_provider/fileapi/file_stream_reader.cc
index c7a5aec20861d765f9c8827f83d2435e5719c61c..f45eb068a001c70522c118c6809a227bbb36b26d 100644
--- a/chrome/browser/chromeos/file_system_provider/fileapi/file_stream_reader.cc
+++ b/chrome/browser/chromeos/file_system_provider/fileapi/file_stream_reader.cc
@@ -5,10 +5,12 @@
 #include "chrome/browser/chromeos/file_system_provider/fileapi/file_stream_reader.h"
 
 #include "base/files/file.h"
+#include "base/memory/ref_counted.h"
 #include "chrome/browser/chromeos/file_system_provider/fileapi/provider_async_file_util.h"
 #include "chrome/browser/chromeos/file_system_provider/mount_path_util.h"
 #include "chrome/browser/chromeos/file_system_provider/provided_file_system_interface.h"
 #include "content/public/browser/browser_thread.h"
+#include "net/base/io_buffer.h"
 #include "net/base/net_errors.h"
 
 using content::BrowserThread;
@@ -94,7 +96,8 @@ void ReadFileOnUIThread(
     return;
   }
 
-  file_system->ReadFile(file_handle, buffer, offset, length, callback);
+  file_system->ReadFile(
+      file_handle, make_scoped_refptr(buffer), offset, length, callback);
 }
 
 // Forward the completion callback to IO thread.
@@ -206,7 +209,7 @@ int FileStreamReader::Read(net::IOBuffer* buffer,
   if (!file_handle_) {
     Initialize(base::Bind(&FileStreamReader::ReadAfterInitialized,
                           weak_ptr_factory_.GetWeakPtr(),
-                          buffer,
+                          make_scoped_refptr(buffer),
                           buffer_length,
                           callback),
                base::Bind(&Int64ToIntCompletionCallback, callback));
@@ -251,7 +254,7 @@ void FileStreamReader::ReadAfterInitialized(
       base::Bind(&ReadFileOnUIThread,
                  file_system_,
                  file_handle_,
-                 buffer,
+                 make_scoped_refptr(buffer),
                  current_offset_,
                  buffer_length,
                  base::Bind(&OnReadChunkReceivedOnUIThread,