Fix a bug in SpdyProxyClientSocket::PopulateUserBuffer, where
subsequent reads from the same buffered data could result in
a crash.
BUG=none
TEST=SpdyProxyClientSocketTest.MultipleReadsFromSameLargeFrame
Review URL: http://codereview.chromium.org/3549022
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@61758 0039d316-1c4b-4281-b951-d872f2087c98
diff --git a/net/spdy/spdy_proxy_client_socket.cc b/net/spdy/spdy_proxy_client_socket.cc
index 966a82c..588af81 100644
--- a/net/spdy/spdy_proxy_client_socket.cc
+++ b/net/spdy/spdy_proxy_client_socket.cc
@@ -143,10 +143,10 @@
while (!read_buffer_.empty() && user_buffer_->BytesRemaining() > 0) {
scoped_refptr<DrainableIOBuffer> data = read_buffer_.front();
const int bytes_to_copy = std::min(user_buffer_->BytesRemaining(),
- data->size());
+ data->BytesRemaining());
memcpy(user_buffer_->data(), data->data(), bytes_to_copy);
user_buffer_->DidConsume(bytes_to_copy);
- if (bytes_to_copy == data->size()) {
+ if (data->BytesRemaining() == 0) {
// Consumed all data from this buffer
read_buffer_.pop_front();
} else {
