FileWriterDelegate should not call URLRequest::Start() after Cancel().

webkit/fileapi/file_system_operation.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef WEBKIT_FILEAPI_FILE_SYSTEM_OPERATION_H_
 #define WEBKIT_FILEAPI_FILE_SYSTEM_OPERATION_H_
 
 #include <string>
 #include <vector>
 
@@ skipping 155 matching lines @@
       int64 usage, int64 quota);
 
   // The 'body' methods that perform the actual work (i.e. posting the
   // file task on proxy_) after the quota check.
   void DoCreateFile(const StatusCallback& callback, bool exclusive);
   void DoCreateDirectory(const StatusCallback& callback,
                          bool exclusive,
                          bool recursive);
   void DoCopy(const StatusCallback& callback);
   void DoMove(const StatusCallback& callback);
-  void DoWrite();
+  void DoWrite(scoped_ptr<net::URLRequest> blob_request);
   void DoTruncate(const StatusCallback& callback, int64 length);
   void DoOpenFile(const OpenFileCallback& callback, int file_flags);
 
   // Callback for CreateFile for |exclusive|=true cases.
   void DidEnsureFileExistsExclusive(const StatusCallback& callback,
                                     base::PlatformFileError rv,
                                     bool created);
 
   // Callback for CreateFile for |exclusive|=false cases.
   void DidEnsureFileExistsNonExclusive(const StatusCallback& callback,
@@ skipping 24 matching lines @@
                 int64 bytes,
                 bool complete);
   void DidTouchFile(const StatusCallback& callback,
                     base::PlatformFileError rv);
   void DidOpenFile(const OpenFileCallback& callback,
                    base::PlatformFileError rv,
                    base::PassPlatformFile file,
                    bool created);
 
   // Helper for Write().
-  void OnFileOpenedForWrite(base::PlatformFileError rv,
+  void OnFileOpenedForWrite(scoped_ptr<net::URLRequest> blob_request,
+                            FileSystemOperationContext* context_unused,
+                            base::PlatformFileError rv,
                             base::PassPlatformFile file,
                             bool created);
 
   // Checks the validity of a given |path_url| and and populates
   // |path| and |file_util| for |mode|.
   base::PlatformFileError SetUpFileSystemPath(
       const GURL& path_url,
       FileSystemPath* file_system_path,
       FileSystemFileUtil** file_util,
       SetUpPathMode mode);
@@ skipping 10 matching lines @@
 
   // This is set before any write operations.  The destructor of
   // ScopedQuotaNotifier sends notification to the QuotaManager
   // to tell the update is done; so that we can make sure notify
   // the manager after any write operations are done.
   scoped_ptr<ScopedQuotaNotifier> scoped_quota_notifier_;
 
   // These are all used only by Write().
   friend class FileWriterDelegate;
   scoped_ptr<FileWriterDelegate> file_writer_delegate_;
-  scoped_ptr<net::URLRequest> blob_request_;
 
   // write_callback is kept in this class for so that we can dispatch it when
   // the operation is cancelled. calcel_callback is kept for canceling a
   // Truncate() operation. We can't actually stop Truncate in another thread;
   // after it resumed from the working thread, cancellation takes place.
   WriteCallback write_callback_;
   StatusCallback cancel_callback_;
   void set_write_callback(const WriteCallback& write_callback) {
     write_callback_ = write_callback;
   }
 
   // Used only by OpenFile, in order to clone the file handle back to the
   // requesting process.
   base::ProcessHandle peer_handle_;
 
   // A flag to make sure we call operation only once per instance.
   OperationType pending_operation_;
 
+  // FileSystemOperation instance is usually deleted upon completion but
+  // could be deleted while it has inflight callbacks when Cancel is called.
+  base::WeakPtrFactory<FileSystemOperation> weak_factory_;
+
   DISALLOW_COPY_AND_ASSIGN(FileSystemOperation);
 };
 
 }  // namespace fileapi
 
 #endif  // WEBKIT_FILEAPI_FILE_SYSTEM_OPERATION_H_