Make URLFetcherCore::ReleaseRequest() release |buffer_|.

net/url_request/url_fetcher_core.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/url_request/url_fetcher_core.h"
 
 #include <stdint.h>
 #include <utility>
 
 #include "base/bind.h"
@@ skipping 798 matching lines @@
   CancelURLRequest(result);
   delegate_task_runner_->PostTask(
       FROM_HERE,
       base::Bind(&URLFetcherCore::InformDelegateFetchIsComplete, this));
 }
 
 void URLFetcherCore::ReleaseRequest() {
   request_context_getter_->RemoveObserver(this);
   upload_progress_checker_timer_.reset();
   request_.reset();
+  buffer_ = nullptr;

[mmenke, 2017/01/25 16:12:30]

BUG:  In some cases, URLFetcherCores retry requests.  They create the buffer in
the constructor, so this will result in crashes.

[xunjieli, 2017/01/25 16:28:15]

Done. Thanks! I forgot about the retry on 5xx and network change.
I changed to initialize |buffer_| in ReadResponse(). If the retry scenario is
infrequent, then lazily initializing it is probably okay?

   g_registry.Get().RemoveURLFetcherCore(this);
 }
 
 base::TimeTicks URLFetcherCore::GetBackoffReleaseTime() {
   DCHECK(network_task_runner_->BelongsToCurrentThread());
 
   if (!original_url_throttler_entry_.get())
     return base::TimeTicks();
 
   base::TimeTicks original_url_backoff =
@@ skipping 123 matching lines @@
 }
 
 void URLFetcherCore::AssertHasNoUploadData() const {
   DCHECK(!upload_content_set_);
   DCHECK(upload_content_.empty());
   DCHECK(upload_file_path_.empty());
   DCHECK(upload_stream_factory_.is_null());
 }
 
 }  // namespace net