URLFetcher should not act on writes to closed temp files.

content/common/net/url_fetcher_impl.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/net/url_fetcher_impl.h"
 
 #include <set>
 
 #include "base/bind.h"
 #include "base/compiler_specific.h"
@@ skipping 362 matching lines @@
   pending_bytes_ = num_bytes;
   buffer_offset_ = 0;
   ContinueWrite(base::PLATFORM_FILE_OK, 0);
 }
 
 void URLFetcherImpl::Core::TempFileWriter::ContinueWrite(
     base::PlatformFileError error_code,
     int bytes_written) {
   DCHECK(core_->io_message_loop_proxy_->BelongsToCurrentThread());
 
+  if (temp_file_handle_ == base::kInvalidPlatformFileValue) {
+    // While a write was being done on the file thread, a request
+    // to close or disown the file occured on the IO thread.  At
+    // this point a request to close the file is pending on the
+    // file thread.
+    return;
+  }
+
+  // Every code path that resets |core_->request_| should reset
+  // |core->temp_file_writer_| or cause the temp file writer to
+  // disown the temp file.  In the former case, this callback can
+  // not be called, because the weak pointer to |this| will be NULL.
+  // In the latter case, the check of |temp_file_handle_| at the start
+  // of this method ensures that we can not reach this point.
+  CHECK(core_->request_.get());
+
   if (base::PLATFORM_FILE_OK != error_code) {
     error_code_ = error_code;
     RemoveTempFile();
     core_->delegate_loop_proxy_->PostTask(
         FROM_HERE, base::Bind(&Core::InformDelegateFetchIsComplete, core_));
     return;
   }
 
   total_bytes_written_ += bytes_written;
   buffer_offset_ += bytes_written;
@@ skipping 712 matching lines @@
 
 // static
 content::URLFetcherFactory* URLFetcherImpl::factory() {
   return g_factory;
 }
 
 // static
 void URLFetcherImpl::set_factory(content::URLFetcherFactory* factory) {
   g_factory = factory;
 }