Prevent URLFetcher::AppendChunkedData from dereferencing NULL pointers.

components/cronet/android/url_request_adapter.cc

Index: components/cronet/android/url_request_adapter.cc
diff --git a/components/cronet/android/url_request_adapter.cc b/components/cronet/android/url_request_adapter.cc
index d6576374ba2a3dd62a6cff3aae2c799ba678d4b4..db9bd69deda3a38ab66c5033624c439afce12da4 100644
--- a/components/cronet/android/url_request_adapter.cc
+++ b/components/cronet/android/url_request_adapter.cc
@@ -129,14 +129,10 @@ void URLRequestAdapter::Start() {
 void URLRequestAdapter::OnAppendChunk(const scoped_ptr<char[]> bytes,
                                       int bytes_len, bool is_last_chunk) {
   DCHECK(OnNetworkThread());
-  // Request could have completed and been destroyed on the network thread
-  // while appendChunk was posting the task from an application thread.
-  if (!url_request_) {
-    VLOG(1) << "Cannot append chunk to destroyed request: "
-            << url_.possibly_invalid_spec().c_str();
-    return;
-  }
-  url_request_->AppendChunkToUpload(bytes.get(), bytes_len, is_last_chunk);
+  // If AppendData returns false, the request has been cancelled or completed
+  // without uploading the entire request body.  Either way, that result will
+  // have been sent to the embedder, so there's nothing else to do here.
+  chunked_upload_writer_->AppendData(bytes.get(), bytes_len, is_last_chunk);
 }
 
 void URLRequestAdapter::OnInitiateConnection() {
@@ -166,7 +162,13 @@ void URLRequestAdapter::OnInitiateConnection() {
   if (upload_data_stream_) {
     url_request_->set_upload(std::move(upload_data_stream_));
   } else if (chunked_upload_) {
-    url_request_->EnableChunkedUpload();
+    scoped_ptr<net::ChunkedUploadDataStream> chunked_upload_data_stream(
+        new net::ChunkedUploadDataStream(0));
+    // Create a ChunkedUploadDataStream::Writer, which keeps a weak reference to
+    // the UploadDataStream, before passing ownership of the stream to the
+    // URLRequest.
+    chunked_upload_writer_ = chunked_upload_data_stream->CreateWriter();
+    url_request_->set_upload(std::move(chunked_upload_data_stream));
   }
 
   url_request_->SetPriority(priority_);