This CL fixes the following issues:-...

chrome_frame/urlmon_url_request.cc

Index: chrome_frame/urlmon_url_request.cc
===================================================================
--- chrome_frame/urlmon_url_request.cc	(revision 31553)
+++ chrome_frame/urlmon_url_request.cc	(working copy)
@@ -46,13 +46,14 @@
     return false;
   }
 
-  worker_thread_->message_loop()->PostTask(
-      FROM_HERE, NewRunnableMethod(this, &UrlmonUrlRequest::StartAsync));
-
   // Take a self reference to maintain COM lifetime. This will be released
   // in EndRequest
   AddRef();
   request_handler()->AddRequest(this);
+
+  worker_thread_->message_loop()->PostTask(
+      FROM_HERE, NewRunnableMethod(this, &UrlmonUrlRequest::StartAsync));
+
   return true;
 }
 
@@ -64,6 +65,11 @@
     return;
   }
 
+  // We can remove the request from the map safely here if it is still valid.
+  // There is an additional reference on the UrlmonUrlRequest instance which
+  // is released when the task scheduled by the EndRequest function executes.
+  request_handler()->RemoveRequest(this);
+
   worker_thread_->message_loop()->PostTask(
       FROM_HERE, NewRunnableMethod(this, &UrlmonUrlRequest::StopAsync));
 }
@@ -205,6 +211,8 @@
     status_.set_os_error(0);
   }
 
+  DLOG(INFO) << "OnStopBinding received for request id: " << id();
+
   // Release these variables after reporting EndRequest since we might need to
   // access their state.
   binding_ = NULL;
@@ -605,6 +613,9 @@
 }
 
 void UrlmonUrlRequest::EndRequestInternal() {
+  // The request object could have been removed from the map in the
+  // OnRequestEnd callback which executes on receiving the
+  // AutomationMsg_RequestEnd IPC from Chrome.
   request_handler()->RemoveRequest(this);
   // Release the outstanding reference in the context of the UI thread to
   // ensure that our instance gets deleted in the same thread which created it.