FileWriterDelegate should not call URLRequest::Start() after Cancel().

webkit/fileapi/file_system_operation.cc

Index: webkit/fileapi/file_system_operation.cc
diff --git a/webkit/fileapi/file_system_operation.cc b/webkit/fileapi/file_system_operation.cc
index 23f87ce5b7e574946f9e6ff7de3e1aa4b41264a0..0fd86aad3fbfb29d811dbbec127a62f46da2c036 100644
--- a/webkit/fileapi/file_system_operation.cc
+++ b/webkit/fileapi/file_system_operation.cc
@@ -289,13 +289,11 @@ void FileSystemOperation::Write(
   file_writer_delegate_.reset(new FileWriterDelegate(
           this, src_path_, offset, proxy_));
   set_write_callback(callback);
-  blob_request_.reset(
-      new net::URLRequest(blob_url, file_writer_delegate_.get()));
-  blob_request_->set_context(url_request_context);
 
   GetUsageAndQuotaThenRunTask(
       src_path_.origin(), src_path_.type(),
-      base::Bind(&FileSystemOperation::DoWrite, base::Unretained(this)),
+      base::Bind(&FileSystemOperation::DoWrite, base::Unretained(this),
+                 blob_url, make_scoped_refptr(url_request_context)),
       base::Bind(callback, base::PLATFORM_FILE_ERROR_FAILED, 0, true));
 }
 
@@ -388,14 +386,13 @@ void FileSystemOperation::OpenFile(const GURL& path_url,
 void FileSystemOperation::Cancel(const StatusCallback& cancel_callback) {
   if (file_writer_delegate_.get()) {
     DCHECK_EQ(kOperationWrite, pending_operation_);
+
     // Writes are done without proxying through FileUtilProxy after the initial
     // opening of the PlatformFile.  All state changes are done on this thread,
     // so we're guaranteed to be able to shut down atomically.  We do need to
     // check that the file has been opened [which means the blob_request_ has
     // been created], so we know how much we need to do.
-    if (blob_request_.get())
-      // This halts any calls to file_writer_delegate_ from blob_request_.
-      blob_request_->Cancel();
+    file_writer_delegate_->Cancel();
 
     if (!write_callback_.is_null()) {
       // Notify the failure status to the ongoing operation's callback.
@@ -539,7 +536,9 @@ void FileSystemOperation::DoMove(const StatusCallback& callback) {
                  base::Owned(this), callback));
 }
 
-void FileSystemOperation::DoWrite() {
+void FileSystemOperation::DoWrite(
+    const GURL& blob_url,
+    const net::URLRequestContext* request_context) {
   int file_flags = base::PLATFORM_FILE_OPEN |
                    base::PLATFORM_FILE_WRITE |
                    base::PLATFORM_FILE_ASYNC;
@@ -547,7 +546,8 @@ void FileSystemOperation::DoWrite() {
   FileSystemFileUtilProxy::CreateOrOpen(
       proxy_, &operation_context_, src_util_, src_path_, file_flags,
       base::Bind(&FileSystemOperation::OnFileOpenedForWrite,
-                 base::Unretained(this)));
+                 base::Unretained(this),
+                 blob_url, make_scoped_refptr(request_context)));
 }
 
 void FileSystemOperation::DoTruncate(const StatusCallback& callback,
@@ -663,6 +663,8 @@ void FileSystemOperation::DidOpenFile(
 }
 
 void FileSystemOperation::OnFileOpenedForWrite(
+    const GURL& blob_url,
+    const net::URLRequestContext* request_context,
     base::PlatformFileError rv,
     base::PassPlatformFile file,
     bool created) {
@@ -672,7 +674,16 @@ void FileSystemOperation::OnFileOpenedForWrite(
     delete this;
     return;
   }
-  file_writer_delegate_->Start(file.ReleaseValue(), blob_request_.get());
+  if (write_callback_.is_null()) {
+    // If cancelled, callback is already invoked and set to null in Cancel().
+    // We must not call it twice. Just shut down this operation object.
+    delete this;
+    return;
+  }
+  scoped_ptr<net::URLRequest> blob_request(
+      new net::URLRequest(blob_url, file_writer_delegate_.get()));
+  blob_request->set_context(request_context);
+  file_writer_delegate_->Start(file.ReleaseValue(), blob_request.Pass());
 }
 
 base::PlatformFileError FileSystemOperation::SetUpFileSystemPath(