Fixed a bug in URLFetcherCore that caused random failures if the object was freed while doing a chu…

content/common/net/url_fetcher_core.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/net/url_fetcher_core.h"
 
 #include "base/bind.h"
 #include "base/file_util_proxy.h"
 #include "base/logging.h"
 #include "base/message_loop_proxy.h"
@@ skipping 544 matching lines @@
     socket_address_ = request_->GetSocketAddress();
     was_fetched_via_proxy_ = request_->was_fetched_via_proxy();
     total_response_bytes_ = request_->GetExpectedContentSize();
   }
 
   ReadResponse();
 }
 
 void URLFetcherCore::CompleteAddingUploadDataChunk(
     const std::string& content, bool is_last_chunk) {
+  if (was_cancelled_) {
+    // Since CompleteAddingUploadDataChunk() is posted as a *delayed* task, it
+    // may run after the URLFetcher was already stopped.
+    return;
+  }
   DCHECK(is_chunked_upload_);
   DCHECK(request_.get());
   DCHECK(!content.empty());
   request_->AppendChunkToUpload(content.data(),
                                 static_cast<int>(content.length()),
                                 is_last_chunk);
 }
 
 // Return true if the write was done and reading may continue.
 // Return false if the write is pending, and the next read will
@@ skipping 340 matching lines @@
       original_url_throttler_entry_ != url_throttler_entry_) {
     destination_url_backoff =
         url_throttler_entry_->GetExponentialBackoffReleaseTime();
   }
 
   return original_url_backoff > destination_url_backoff ?
       original_url_backoff : destination_url_backoff;
 }
 
 }  // namespace content