Add instrumentation to track down a crash....

chrome/browser/net/url_fetcher.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/net/url_fetcher.h"
 
 #include "base/compiler_specific.h"
 #include "base/string_util.h"
 #include "base/thread.h"
 #include "chrome/browser/browser_process.h"
@@ skipping 77 matching lines @@
   // incrementally back off how rapidly we'll send requests to a particular
   // URL, to avoid placing too much demand on the remote resource.  We update
   // this with the status of all requests as they return, and in turn use it
   // to determine how long to wait before making another request.
   URLFetcherProtectEntry* protect_entry_;
   // |num_retries_| indicates how many times we've failed to successfully
   // fetch this URL.  Once this value exceeds the maximum number of retries
   // specified by the protection manager, we'll give up.
   int num_retries_;
 
+  // Temporary member variable to test whether requests are being started
+  // after they have already been cancelled.
+  // TODO(eroman): Remove this after done investigating 27074.
+  bool was_cancelled_;

[wtc, 2009/11/10 01:09:25]

You explained what this member is for, but you should also
describe what it is.
  True if the request has been cancelled.
or
  True if CancelURLRequest has been called.

+
   friend class URLFetcher;
   DISALLOW_COPY_AND_ASSIGN(Core);
 };
 
 // static
 URLFetcher::Factory* URLFetcher::factory_ = NULL;
 
 URLFetcher::URLFetcher(const GURL& url,
                        RequestType request_type,
                        Delegate* d)
@@ skipping 20 matching lines @@
       original_url_(original_url),
       request_type_(request_type),
       delegate_(d),
       delegate_loop_(MessageLoop::current()),
       request_(NULL),
       load_flags_(net::LOAD_NORMAL),
       response_code_(-1),
       buffer_(new net::IOBuffer(kBufferSize)),
       protect_entry_(URLFetcherProtectManager::GetInstance()->Register(
           original_url_.host())),
-      num_retries_(0) {
+      num_retries_(0),
+      was_cancelled_(false) {
 }
 
 void URLFetcher::Core::Start() {
   DCHECK(delegate_loop_);
-  DCHECK(request_context_getter_) << "We need an URLRequestContext!";
+  CHECK(request_context_getter_) << "We need an URLRequestContext!";
   ChromeThread::PostDelayedTask(
       ChromeThread::IO, FROM_HERE,
       NewRunnableMethod(this, &Core::StartURLRequest),
           protect_entry_->UpdateBackoff(URLFetcherProtectEntry::SEND));
 }
 
 void URLFetcher::Core::Stop() {
   DCHECK_EQ(MessageLoop::current(), delegate_loop_);
   delegate_ = NULL;
   ChromeThread::PostTask(
@@ skipping 38 matching lines @@
   if (!request_->status().is_io_pending() || (request_type_ == HEAD)) {
     delegate_loop_->PostTask(FROM_HERE, NewRunnableMethod(
         this, &Core::OnCompletedURLRequest, request_->status()));
     delete request_;
     request_ = NULL;
   }
 }
 
 void URLFetcher::Core::StartURLRequest() {
   DCHECK(ChromeThread::CurrentlyOn(ChromeThread::IO));
-  DCHECK(!request_);
+  CHECK(!was_cancelled_);
+  CHECK(request_context_getter_);
+  CHECK(!request_);
 
   request_ = new URLRequest(original_url_, this);
   int flags = request_->load_flags() | load_flags_;
   if (!g_interception_enabled) {
     flags = flags | net::LOAD_DISABLE_INTERCEPT;
   }
   request_->set_load_flags(flags);
   request_->set_context(request_context_getter_->GetURLRequestContext());
 
   switch (request_type_) {
@@ skipping 32 matching lines @@
   if (request_) {
     request_->Cancel();
     delete request_;
     request_ = NULL;
   }
   // Release the reference to the request context. There could be multiple
   // references to URLFetcher::Core at this point so it may take a while to
   // delete the object, but we cannot delay the destruction of the request
   // context.
   request_context_getter_ = NULL;
+  was_cancelled_ = true;
 }
 
 void URLFetcher::Core::OnCompletedURLRequest(const URLRequestStatus& status) {
   DCHECK(MessageLoop::current() == delegate_loop_);
 
   // Checks the response from server.
   if (response_code_ >= 500) {
     // When encountering a server error, we will send the request again
     // after backoff time.
     const int64 wait =
@@ skipping 50 matching lines @@
   core_->Start();
 }
 
 const GURL& URLFetcher::url() const {
   return core_->url_;
 }
 
 URLFetcher::Delegate* URLFetcher::delegate() const {
   return core_->delegate();
 }