Cancel the request when URLLoader is gone

content/browser/service_worker/service_worker_fetch_dispatcher.cc

Index: content/browser/service_worker/service_worker_fetch_dispatcher.cc
diff --git a/content/browser/service_worker/service_worker_fetch_dispatcher.cc b/content/browser/service_worker/service_worker_fetch_dispatcher.cc
index 64aaa7c8cef5a6a879251a07a93c748ab0a5f163..12e9cd3be7f8b204464ca05f736e83e5748496d1 100644
--- a/content/browser/service_worker/service_worker_fetch_dispatcher.cc
+++ b/content/browser/service_worker/service_worker_fetch_dispatcher.cc
@@ -46,13 +46,23 @@ class DelegatingURLLoader final : public mojom::URLLoader {
   ~DelegatingURLLoader() override {}
 
   void FollowRedirect() override { loader_->FollowRedirect(); }
-  void Cancel() override { loader_->Cancel(); }
 
   mojom::URLLoaderPtr CreateInterfacePtrAndBind() {
-    return binding_.CreateInterfacePtrAndBind();
+    auto p = binding_.CreateInterfacePtrAndBind();
+    // This unretained pointer is safe, because |binding_| is owned by |this|
+    // and the callback will never be called after |this| is destroyed.
+    binding_.set_connection_error_handler(
+        base::Bind(&DelegatingURLLoader::Cancel, base::Unretained(this)));
+    return p;
   }
 
  private:
+  // Called when the mojom::URLLoaderPtr in the service worker is deleted.
+  void Cancel() {
+    // Cancel loading as stated in url_loader.mojom.
+    loader_ = nullptr;
+  }
+
   mojo::Binding<mojom::URLLoader> binding_;
   mojom::URLLoaderAssociatedPtr loader_;