Do not set io_loop_ to NULL until we have deleted request_ and set...

net/ocsp/nss_ocsp.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/ocsp/nss_ocsp.h"
 
 #include <certt.h>
 #include <certdb.h>
 #include <ocsp.h>
 #include <nspr.h>
@@ skipping 198 matching lines @@
     DCHECK_EQ(request, request_);
     DCHECK_EQ(MessageLoopForIO::current(), io_loop_);
 
     do {
       if (!request_->status().is_success() || bytes_read <= 0)
         break;
       data_.append(buffer_->data(), bytes_read);
     } while (request_->Read(buffer_, kRecvBufferSize, &bytes_read));
 
     if (!request_->status().is_io_pending()) {
-      MessageLoop* io_loop = io_loop_;
+      delete request_;
+      request_ = NULL;
+      io_loop_->RemoveDestructionObserver(this);
       {
         AutoLock autolock(lock_);
         finished_ = true;
         io_loop_ = NULL;
       }
       cv_.Signal();
-      delete request_;
-      request_ = NULL;
-      io_loop->RemoveDestructionObserver(this);
     }
   }
 
   virtual void WillDestroyCurrentMessageLoop() {
     DCHECK_EQ(MessageLoopForIO::current(), io_loop_);
     {
       AutoLock autolock(lock_);
       io_loop_ = NULL;
     }
     if (request_) {
@@ skipping 320 matching lines @@
 // This function would be called before NSS initialization.
 void SetURLRequestContextForOCSP(URLRequestContext* request_context) {
   OCSPInitSingleton::set_url_request_context(request_context);
 }
 
 URLRequestContext* GetURLRequestContextForOCSP() {
   return OCSPInitSingleton::url_request_context();
 }
 
 }  // namespace net