Fix a ChromeFrame crash which occurs in the background worker thread while dereferencing a NULL a...

chrome_frame/urlmon_url_request.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome_frame/urlmon_url_request.h"
 
 #include <urlmon.h>
 #include <wininet.h>
 
 #include "base/callback_old.h"
@@ skipping 1243 matching lines @@
 
   StopAllRequestsHelper(&request_map_, NULL);
 
   if (background_worker_thread_enabled_) {
     DCHECK(background_thread_.get());
     background_thread_->message_loop()->PostTask(
         FROM_HERE,
         NewRunnableMethod(
             this, &UrlmonUrlRequestManager::StopAllRequestsHelper,
             &background_request_map_, &background_resource_map_lock_));
+     background_thread_->Stop();
+     background_thread_.reset();
   }
 }
 
 void UrlmonUrlRequestManager::StopAllRequestsHelper(
     RequestMap* request_map,
     base::Lock* request_map_lock) {
   DCHECK(request_map);
 
   DVLOG(1) << __FUNCTION__ << " stopping " << request_map->size()
            << " requests";
@@ skipping 93 matching lines @@
       GetConfigBool(true, kUseBackgroundThreadForSubResources);
   if (background_worker_thread_enabled_) {
     base::Thread::Options options;
     options.message_loop_type = MessageLoop::TYPE_UI;
     background_thread_->StartWithOptions(options);
   }
 }
 
 UrlmonUrlRequestManager::~UrlmonUrlRequestManager() {
   StopAll();
-  if (background_worker_thread_enabled_)
-    background_thread_->Stop();
 }
 
 void UrlmonUrlRequestManager::AddPrivacyDataForUrl(
     const std::string& url, const std::string& policy_ref,
     int32 flags) {
   DCHECK(!url.empty());
 
   bool fire_privacy_event = false;
 
   if (privacy_info_.privacy_records.empty())
@@ skipping 27 matching lines @@
 }
 
 void UrlmonUrlRequestManager::ResourceFetcherThread::Init() {
   CoInitialize(NULL);
 }
 
 void UrlmonUrlRequestManager::ResourceFetcherThread::CleanUp() {
   CoUninitialize();
 }