Fix pipelining crash on canceled user callbacks.

net/http/http_pipelined_connection_impl.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_HTTP_HTTP_PIPELINED_CONNECTION_IMPL_H_
 #define NET_HTTP_HTTP_PIPELINED_CONNECTION_IMPL_H_
 #pragma once
 
 #include <map>
 #include <queue>
@@ skipping 142 matching lines @@
     HttpResponseInfo* response;
     OldCompletionCallback* callback;
   };
 
   struct StreamInfo {
     StreamInfo();
     ~StreamInfo();
 
     linked_ptr<HttpStreamParser> parser;
     OldCompletionCallback* read_headers_callback;
+    OldCompletionCallback* pending_user_callback;
     StreamState state;
   };
 
   typedef std::map<int, StreamInfo> StreamInfoMap;
 
   // Called after the first request is sent or in a task sometime after the
   // first stream is added to this pipeline. This gives the first request
   // priority to send, but doesn't hold up other requests if it doesn't.
   // When called the first time, notifies the |delegate_| that we can accept new
   // requests.
@@ skipping 55 matching lines @@
   // happen if there is an error with the pipeline or one of our
   // HttpPipelinedSockets indicates the connection was suddenly closed.
   int DoEvictPendingReadHeaders(int result);
 
   // Invokes the user's callback in response to SendRequest() or
   // ReadResponseHeaders() completing on an underlying parser. This might be
   // invoked in response to our own IO callbacks, or it may be invoked if the
   // underlying parser completes SendRequest() or ReadResponseHeaders()
   // synchronously, but we've already returned ERR_IO_PENDING to the user's
   // SendRequest() or ReadResponseHeaders() call into us.
-  void FireUserCallback(OldCompletionCallback* callback, int result);
+  void FireUserCallback(int pipeline_id, int result);
 
   Delegate* delegate_;
   scoped_ptr<ClientSocketHandle> connection_;
   SSLConfig used_ssl_config_;
   ProxyInfo used_proxy_info_;
   BoundNetLog net_log_;
   bool was_npn_negotiated_;
   scoped_refptr<GrowableIOBuffer> read_buf_;
   int next_pipeline_id_;
   bool active_;
@@ skipping 13 matching lines @@
   ReadHeadersState read_next_state_;
   OldCompletionCallbackImpl<HttpPipelinedConnectionImpl> read_io_callback_;
   OldCompletionCallback* read_user_callback_;
 
   DISALLOW_COPY_AND_ASSIGN(HttpPipelinedConnectionImpl);
 };
 
 }  // namespace net
 
 #endif  // NET_HTTP_HTTP_PIPELINED_CONNECTION_IMPL_H_