Pin dictionaries from being deleted while request is outstanding.

net/filter/sdch_filter.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // SdchFilter applies open_vcdiff content decoding to a datastream.
 // This decoding uses a pre-cached dictionary of text fragments to decode
 // (expand) the stream back to its original contents.
 //
 // This SdchFilter internally uses open_vcdiff/vcdec library to do decoding.
 //
@@ skipping 71 matching lines @@
   std::string dictionary_hash_;
 
   // After assembling an entire dictionary hash (the first 9 bytes of the
   // sdch payload, we check to see if it is plausible, meaning it has a null
   // termination, and has 8 characters that are possible in a net-safe base64
   // encoding.  If the hash is not plausible, then the payload is probably not
   // an SDCH encoded bundle, and various error recovery strategies can be
   // attempted.
   bool dictionary_hash_is_plausible_;
 
-  // We hold an in-memory copy of the dictionary during the entire decoding, as
-  // it is used directly by the VC-DIFF decoding system.
-  // That char* data is part of the dictionary_ we hold a reference to.
-  scoped_refptr<SdchManager::Dictionary> dictionary_;
+  // Validity of this pointer is guaranteed by either the FilterContext holding
+  // a containing SdchManager::DictionarySet, or this object holding a
+  // container in |unexpected_dictionary_handle_| below.
+  const SdchManager::Dictionary *dictionary_;
 
   // We keep a copy of the URLRequestContext for use in the destructor, (at
   // which point GetURLRequestContext() will likely return null because of
   // the disassociation of the URLRequest from the URLRequestJob).  This is
   // safe because the URLRequestJob (and any filters) are guaranteed to be
   // deleted before the URLRequestContext is destroyed.
   const URLRequestContext* const url_request_context_;
 
   // The decoder may demand a larger output buffer than the target of
   // ReadFilteredData so we buffer the excess output between calls.
@@ skipping 13 matching lines @@
   bool possible_pass_through_;
 
   // The URL that is currently being filtered.
   // This is used to restrict use of a dictionary to a specific URL or path.
   GURL url_;
 
   // To facilitate error recovery, allow filter to know if content is text/html
   // by checking within this mime type (we may do a meta-refresh via html).
   std::string mime_type_;
 
+  // If the response was encoded with a dictionary different than those
+  // advertised (e.g. a cached response using an old dictionary), this
+  // variable preserves that dictionary from deletion during decoding.
+  scoped_ptr<SdchManager::DictionarySet> unexpected_dictionary_handle_;
+
   DISALLOW_COPY_AND_ASSIGN(SdchFilter);
 };
 
 }  // namespace net
 
 #endif  // NET_FILTER_SDCH_FILTER_H_