Fix for 1498134, possible crash when cancelling a url request. The...

chrome/browser/resource_dispatcher_host.h

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This is the browser side of the resource dispatcher, it receives requests
 // from the RenderProcessHosts, and dispatches them to URLRequests. It then
 // fowards the messages from the URLRequests back to the correct process for
 // handling.
 //
 // See http://wiki.corp.google.com/twiki/bin/view/Main/ChromeMultiProcessResourceLoading
@@ skipping 378 matching lines @@
 
   // Internal function to finish an async IO which has completed.  Returns
   // true if there is more data to read (e.g. we haven't read EOF yet and
   // no errors have occurred).
   bool CompleteRead(URLRequest *, int* bytes_read);
 
   // Internal function to finish handling the ResponseStarted message.  Returns
   // true on success.
   bool CompleteResponseStarted(URLRequest* request);
 
+  // Cancels the given request if it still exists. We ignore cancels from the
+  // renderer in the event of a download. If |allow_delete| is true and no IO
+  // is pending, the request is removed and deleted.
+  void CancelRequest(int render_process_host_id,
+                     int request_id,
+                     bool from_renderer,
+                     bool allow_delete);
+
   // Helper function for regular and download requests.
   void BeginRequestInternal(URLRequest* request, bool mixed_content);
 
   // The list of all requests that we have pending. This list is not really
   // optimized, and assumes that we have relatively few requests pending at once
   // since some operations require brute-force searching of the list.
   //
   // It may be enhanced in the future to provide some kind of prioritization
   // mechanism. We should also consider a hashtable or binary tree if it turns
   // out we have a lot of things here.
@@ skipping 75 matching lines @@
   // For running tasks.
   ScopedRunnableMethodFactory<ResourceDispatcherHost> method_runner_;
 
   // True if the resource dispatcher host has been shut down.
   bool is_shutdown_;
 
   DISALLOW_EVIL_CONSTRUCTORS(ResourceDispatcherHost);
 };
 
 #endif  // CHROME_BROWSER_RESOURCE_DISPATCHER_HOST_H__