This CL fixes the following issues:-...

chrome_frame/urlmon_url_request.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome_frame/urlmon_url_request.h"
 
 #include <wininet.h>
 
 #include "base/scoped_ptr.h"
 #include "base/string_util.h"
@@ skipping 28 matching lines @@
 }
 
 bool UrlmonUrlRequest::Start() {
   DCHECK_EQ(PlatformThread::CurrentId(), thread_);
 
   if (!worker_thread_) {
     NOTREACHED() << __FUNCTION__ << " Urlmon request thread not initialized";
     return false;
   }
 
-  worker_thread_->message_loop()->PostTask(
-      FROM_HERE, NewRunnableMethod(this, &UrlmonUrlRequest::StartAsync));
-
   // Take a self reference to maintain COM lifetime. This will be released
   // in EndRequest
   AddRef();
   request_handler()->AddRequest(this);
+
+  worker_thread_->message_loop()->PostTask(
+      FROM_HERE, NewRunnableMethod(this, &UrlmonUrlRequest::StartAsync));
+
   return true;
 }
 
 void UrlmonUrlRequest::Stop() {
   DCHECK_EQ(PlatformThread::CurrentId(), thread_);
 
   if (!worker_thread_) {
     NOTREACHED() << __FUNCTION__ << " Urlmon request thread not initialized";
     return;
   }
 
+  // We can remove the request from the map safely here if it is still valid.
+  // There is an additional reference on the UrlmonUrlRequest instance which
+  // is released when the task scheduled by the EndRequest function executes.
+  request_handler()->RemoveRequest(this);
+
   worker_thread_->message_loop()->PostTask(
       FROM_HERE, NewRunnableMethod(this, &UrlmonUrlRequest::StopAsync));
 }
 
 void UrlmonUrlRequest::StartAsync() {
   DCHECK(worker_thread_ != NULL);
 
   status_.set_status(URLRequestStatus::IO_PENDING);
   HRESULT hr = StartAsyncDownload();
   if (FAILED(hr)) {
@@ skipping 121 matching lines @@
       " Status: " << status_.status();
   if (FAILED(result)) {
     status_.set_status(URLRequestStatus::FAILED);
     status_.set_os_error(HresultToNetError(result));
     EndRequest();
   } else {
     status_.set_status(URLRequestStatus::SUCCESS);
     status_.set_os_error(0);
   }
 
+  DLOG(INFO) << "OnStopBinding received for request id: " << id();
+
   // Release these variables after reporting EndRequest since we might need to
   // access their state.
   binding_ = NULL;
   bind_context_ = NULL;
 
   return S_OK;
 }
 
 STDMETHODIMP UrlmonUrlRequest::GetBindInfo(DWORD* bind_flags,
     BINDINFO *bind_info) {
@@ skipping 380 matching lines @@
   DCHECK(task_marshaller_ != NULL);
 
   // Remove the request mapping and release the outstanding reference to us in
   // the context of the UI thread.
   task_marshaller_->PostTask(
       FROM_HERE, NewRunnableMethod(this,
                                    &UrlmonUrlRequest::EndRequestInternal));
 }
 
 void UrlmonUrlRequest::EndRequestInternal() {
+  // The request object could have been removed from the map in the
+  // OnRequestEnd callback which executes on receiving the
+  // AutomationMsg_RequestEnd IPC from Chrome.
   request_handler()->RemoveRequest(this);
   // Release the outstanding reference in the context of the UI thread to
   // ensure that our instance gets deleted in the same thread which created it.
   Release();
 }
 
 int UrlmonUrlRequest::GetHttpResponseStatus() const {
   if (binding_ == NULL) {
     DLOG(WARNING) << "GetHttpResponseStatus - no binding_";
     return 0;
@@ skipping 181 matching lines @@
       ret = net::ERR_ACCESS_DENIED;
       break;
 
     default:
       DLOG(WARNING)
           << StringPrintf("TODO: translate HRESULT 0x%08X to net::Error", hr);
       break;
   }
   return ret;
 }