Always erase CBF_SMBITMAP from the clipboard object map for async writes

This can never be a pointer to a valid object, since this CBF_SMBITMAP
is only used for synchronous writes to the clipboard. This accidentally
regressed in http://crrev.com/123088.

BUG=319125
R=jorgelo@chromium.org
TBR=creis@chromium.org

Review URL: https://codereview.chromium.org/72483002

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@235085 0039d316-1c4b-4281-b951-d872f2087c98

content/browser/renderer_host/clipboard_message_filter.cc

@@ -114,23 +114,24 @@ void ClipboardMessageFilter::OnWriteObjectsSync(
 
 void ClipboardMessageFilter::OnWriteObjectsAsync(
     const ui::Clipboard::ObjectMap& objects) {
+  // This async message doesn't support shared-memory based bitmaps; they must
+  // be removed otherwise we might dereference a rubbish pointer.
+  scoped_ptr<ui::Clipboard::ObjectMap> sanitized_objects(
+      new ui::Clipboard::ObjectMap(objects));
+  sanitized_objects->erase(ui::Clipboard::CBF_SMBITMAP);
+
 #if defined(OS_WIN)
   // We cannot write directly from the IO thread, and cannot service the IPC
   // on the UI thread. We'll copy the relevant data and post a task to preform
   // the write on the UI thread.
-  ui::Clipboard::ObjectMap* long_living_objects =
-      new ui::Clipboard::ObjectMap(objects);
-
-  // This async message doesn't support shared-memory based bitmaps; they must
-  // be removed otherwise we might dereference a rubbish pointer.
-  long_living_objects->erase(ui::Clipboard::CBF_SMBITMAP);
-
   BrowserThread::PostTask(
       BrowserThread::UI,
       FROM_HERE,
-      base::Bind(&WriteObjectsOnUIThread, base::Owned(long_living_objects)));
+      base::Bind(
+          &WriteObjectsOnUIThread, base::Owned(sanitized_objects.release())));
 #else
-  GetClipboard()->WriteObjects(ui::CLIPBOARD_TYPE_COPY_PASTE, objects);
+  GetClipboard()->WriteObjects(
+      ui::CLIPBOARD_TYPE_COPY_PASTE, *sanitized_objects.get());
 #endif
 }