This CL fixes the following issues:-...

chrome_frame/chrome_frame_automation.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome_frame/chrome_frame_automation.h"
 
 #include "base/command_line.h"
 #include "base/compiler_specific.h"
 #include "base/file_util.h"
 #include "base/file_version_info.h"
@@ skipping 1000 matching lines @@
   bool result = false;
   PluginUrlRequest* request = LookupRequest(request_id);
   if (request)
     result = request->Read(bytes_to_read);
 
   return result;
 }
 
 void ChromeFrameAutomationClient::RemoveRequest(PluginUrlRequest* request) {
   DCHECK_EQ(PlatformThread::CurrentId(), ui_thread_id_);
-  DCHECK(request_map_.end() != request_map_.find(request->id()));
-  request_map_.erase(request->id());
+
+  // We check if the request pointer passed in is actually present in the map
+  // before going ahead and deleting it. This avoids the issue where we would
+  // incorrectly delete a different request with the same request id.
+  if (IsValidRequest(request)) {
+    request_map_.erase(request->id());
+  }
 }
 
 void ChromeFrameAutomationClient::RemoveRequest(int request_id, bool abort) {
   DCHECK_EQ(PlatformThread::CurrentId(), ui_thread_id_);
   PluginUrlRequest* request = LookupRequest(request_id);
   if (request) {
     if (abort) {
       // The request object will get removed asynchronously.
       request->Stop();
     } else {
@@ skipping 41 matching lines @@
       request->Stop();
     }
   }
 
   DCHECK(request_map_.empty());
   request_map_.clear();
 }
 
 void ChromeFrameAutomationClient::CleanupAsyncRequests() {
   DCHECK_EQ(PlatformThread::CurrentId(), ui_thread_id_);
+
+  std::vector<scoped_refptr<PluginUrlRequest> > request_list;
+  // We copy the pending requests into a temporary vector as the Stop
+  // function in the request could also try to delete the request from
+  // the request map and the iterator could end up being invalid.
   RequestMap::iterator index = request_map_.begin();
   while (index != request_map_.end()) {
     PluginUrlRequest* request = (*index).second;
-    if (request) {
-      int request_id = request->id();
-      request->Stop();
-    }
+    DCHECK(request != NULL);
+    request_list.push_back(request);
     index++;
   }
+  request_map_.clear();
 
-  request_map_.clear();
+  for (unsigned int index = 0; index < request_list.size(); ++index) {
+    request_list[index]->Stop();
+  }
 }
 
 bool ChromeFrameAutomationClient::Reinitialize(
     ChromeFrameDelegate* delegate) {
   if (!tab_.get() || !::IsWindow(chrome_window_)) {
     NOTREACHED();
     DLOG(WARNING) << "ChromeFrameAutomationClient instance reused "
                   << "with invalid tab";
     return false;
   }
 
   if (!delegate) {
     NOTREACHED();
     return false;
   }
 
+  CleanupAsyncRequests();
   chrome_frame_delegate_ = delegate;
   SetParentWindow(NULL);
   return true;
 }
 
 void ChromeFrameAutomationClient::AttachExternalTab(
     intptr_t external_tab_cookie) {
   DCHECK_EQ(static_cast<TabProxy*>(NULL), tab_.get());
   DCHECK_EQ(-1, tab_handle_);
 
   external_tab_cookie_ = external_tab_cookie;
 }
 
 void ChromeFrameAutomationClient::SetPageFontSize(
     enum AutomationPageFontSize font_size) {
   if (font_size < SMALLEST_FONT ||
       font_size > LARGEST_FONT) {
       NOTREACHED() << "Invalid font size specified : "
                    << font_size;
       return;
   }
 
   Send(new AutomationMsg_SetPageFontSize(0, tab_handle_, font_size));
 }