Make sure read/write buffer alive in TCPSocketLibevent.

net/socket/tcp_socket_libevent.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/tcp_socket.h"
 
 #include <errno.h>
 #include <netinet/tcp.h>
 #include <sys/socket.h>
 
@@ skipping 193 matching lines @@
 
 int TCPSocketLibevent::Read(IOBuffer* buf,
                             int buf_len,
                             const CompletionCallback& callback) {
   DCHECK(socket_);
   DCHECK(!callback.is_null());
 
   int rv = socket_->Read(
       buf, buf_len,
       base::Bind(&TCPSocketLibevent::ReadCompleted,
-                 base::Unretained(this), base::Unretained(buf), callback));
+                 base::Unretained(this), make_scoped_refptr(buf), callback));
   if (rv >= 0)
     RecordFastOpenStatus();
   if (rv != ERR_IO_PENDING)
     rv = HandleReadCompleted(buf, rv);
   return rv;
 }
 
 int TCPSocketLibevent::Write(IOBuffer* buf,
                              int buf_len,
                              const CompletionCallback& callback) {
   DCHECK(socket_);
   DCHECK(!callback.is_null());
 
   CompletionCallback write_callback =
       base::Bind(&TCPSocketLibevent::WriteCompleted,
-                 base::Unretained(this), base::Unretained(buf), callback);
+                 base::Unretained(this), make_scoped_refptr(buf), callback);
   int rv;
   if (use_tcp_fastopen_ && !tcp_fastopen_connected_) {
     rv = TcpFastOpenWrite(buf, buf_len, write_callback);
   } else {
     rv = socket_->Write(buf, buf_len, write_callback);
   }
 
   if (rv != ERR_IO_PENDING)
     rv = HandleWriteCompleted(buf, rv);
   return rv;
@@ skipping 237 matching lines @@
     NOTREACHED();
     net_log_.EndEventWithNetErrorCode(NetLog::TYPE_TCP_CONNECT, rv);
     return;
   }
 
   net_log_.EndEvent(NetLog::TYPE_TCP_CONNECT,
                     CreateNetLogSourceAddressCallback(storage.addr,
                                                       storage.addr_len));
 }
 
-void TCPSocketLibevent::ReadCompleted(IOBuffer* buf,
+void TCPSocketLibevent::ReadCompleted(scoped_refptr<IOBuffer> buf,
                                       const CompletionCallback& callback,
                                       int rv) {
   DCHECK_NE(ERR_IO_PENDING, rv);
   // Records fast open status regardless of error in asynchronous case.
   // TODO(rdsmith,jri): Change histogram name to indicate it could be called on
   // error.
   RecordFastOpenStatus();
   callback.Run(HandleReadCompleted(buf, rv));
 }
 
 int TCPSocketLibevent::HandleReadCompleted(IOBuffer* buf, int rv) {
   if (rv < 0) {
     net_log_.AddEvent(NetLog::TYPE_SOCKET_READ_ERROR,
                       CreateNetLogSocketErrorCallback(rv, errno));
     return rv;
   }
 
   base::StatsCounter read_bytes("tcp.read_bytes");
   read_bytes.Add(rv);
   net_log_.AddByteTransferEvent(NetLog::TYPE_SOCKET_BYTES_RECEIVED, rv,
                                 buf->data());
   return rv;
 }
 
-void TCPSocketLibevent::WriteCompleted(IOBuffer* buf,
+void TCPSocketLibevent::WriteCompleted(scoped_refptr<IOBuffer> buf,
                                        const CompletionCallback& callback,
                                        int rv) const {
   DCHECK_NE(ERR_IO_PENDING, rv);
   callback.Run(HandleWriteCompleted(buf, rv));
 }
 
 int TCPSocketLibevent::HandleWriteCompleted(IOBuffer* buf, int rv) const {
   if (rv < 0) {
     net_log_.AddEvent(NetLog::TYPE_SOCKET_WRITE_ERROR,
                       CreateNetLogSocketErrorCallback(rv, errno));
     return rv;
   }
 
   base::StatsCounter write_bytes("tcp.write_bytes");
   write_bytes.Add(rv);
   net_log_.AddByteTransferEvent(NetLog::TYPE_SOCKET_BYTES_SENT, rv,
                                 buf->data());

[Ryan Sleevi, 2014/07/11 18:13:35]

Right, this is the unsafe access point.

[byungchul, 2014/07/11 18:58:18]

Yes.

   return rv;
 }
 
 int TCPSocketLibevent::TcpFastOpenWrite(
     IOBuffer* buf,
     int buf_len,
     const CompletionCallback& callback) {
   SockaddrStorage storage;
   int rv = socket_->GetPeerAddress(&storage);
   if (rv != OK)
@@ skipping 70 matching lines @@
       }
     } else {
       fast_open_status_ = (fast_open_status_ == FAST_OPEN_FAST_CONNECT_RETURN ?
                            FAST_OPEN_SYN_DATA_FAILED :
                            FAST_OPEN_NO_SYN_DATA_FAILED);
     }
   }
 }
 
 }  // namespace net