Fixed crash in ResourceDispatcher::OnReceivedRedirect()

chrome/common/resource_dispatcher.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // See http://dev.chromium.org/developers/design-documents/multi-process-resource-loading
 
 #include "chrome/common/resource_dispatcher.h"
 
 #include "base/basictypes.h"
 #include "base/compiler_specific.h"
@@ skipping 384 matching lines @@
   PendingRequestInfo* request_info = GetPendingRequestInfo(request_id);
   if (!request_info)
     return;
 
   int32 routing_id = message.routing_id();
   bool has_new_first_party_for_cookies = false;
   GURL new_first_party_for_cookies;
   if (request_info->peer->OnReceivedRedirect(new_url, info,
                                             &has_new_first_party_for_cookies,
                                             &new_first_party_for_cookies)) {
+    // Double-check if the request is still around. The call above could
+    // potentially remove it.
+    request_info = GetPendingRequestInfo(request_id);
+    if (!request_info)
+      return;
     request_info->pending_redirect_message.reset(
         new ViewHostMsg_FollowRedirect(routing_id, request_id,
                                        has_new_first_party_for_cookies,
                                        new_first_party_for_cookies));
     if (!request_info->is_deferred) {
       FollowPendingRedirect(request_id, *request_info);
     }
   } else {
     CancelPendingRequest(routing_id, request_id);
   }
@@ skipping 194 matching lines @@
 
 // static
 void ResourceDispatcher::ReleaseResourcesInMessageQueue(MessageQueue* queue) {
   while (!queue->empty()) {
     IPC::Message* message = queue->front();
     ReleaseResourcesInDataMessage(*message);
     queue->pop_front();
     delete message;
   }
 }