Make URLFetcherCore::ReleaseRequest() release |buffer_|.

net/url_request/url_fetcher_core.cc

Index: net/url_request/url_fetcher_core.cc
diff --git a/net/url_request/url_fetcher_core.cc b/net/url_request/url_fetcher_core.cc
index 2a7a4d2899830a41287eab8107b5f2f462ece75d..f23ef3bd86f2bc81732dd6637edf2a753b41ae9a 100644
--- a/net/url_request/url_fetcher_core.cc
+++ b/net/url_request/url_fetcher_core.cc
@@ -816,6 +816,7 @@ void URLFetcherCore::ReleaseRequest() {
   request_context_getter_->RemoveObserver(this);
   upload_progress_checker_timer_.reset();
   request_.reset();
+  buffer_ = nullptr;

[mmenke, 2017/01/25 16:12:30]

BUG:  In some cases, URLFetcherCores retry requests.  They create the buffer in
the constructor, so this will result in crashes.

[xunjieli, 2017/01/25 16:28:15]

Done. Thanks! I forgot about the retry on 5xx and network change.
I changed to initialize |buffer_| in ReadResponse(). If the retry scenario is
infrequent, then lazily initializing it is probably okay?

   g_registry.Get().RemoveURLFetcherCore(this);
 }