Fixed a bug in URLFetcherCore that caused random failures if the object was freed while doing a chu…

content/common/net/url_fetcher_core.cc

Index: content/common/net/url_fetcher_core.cc
diff --git a/content/common/net/url_fetcher_core.cc b/content/common/net/url_fetcher_core.cc
index c384146c0c2bda719755f616076a2060d141df58..a067ed6c8f9917eaf175a549e0d1bc6715ffed46 100644
--- a/content/common/net/url_fetcher_core.cc
+++ b/content/common/net/url_fetcher_core.cc
@@ -562,6 +562,11 @@ void URLFetcherCore::OnResponseStarted(net::URLRequest* request) {
 
 void URLFetcherCore::CompleteAddingUploadDataChunk(
     const std::string& content, bool is_last_chunk) {
+  if (was_cancelled_) {
+    // Since CompleteAddingUploadDataChunk() is posted as a *delayed* task, it
+    // may run after the URLFetcher was already stopped.
+    return;
+  }
   DCHECK(is_chunked_upload_);
   DCHECK(request_.get());
   DCHECK(!content.empty());