Fix a crash caused by a race condition between the time the UrlmonUrlRequest:...

chrome_frame/urlmon_url_request.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome_frame/urlmon_url_request.h"
 
 #include <wininet.h>
 
 #include "base/scoped_ptr.h"
 #include "base/string_util.h"
@@ skipping 297 matching lines @@
       " - Request stopped, Result: " << std::hex << result <<
       " Status: " << status_.status();
 
   if (FAILED(result)) {
     status_.set_status(URLRequestStatus::FAILED);
     status_.set_os_error(HresultToNetError(result));
     EndRequest();
   } else {
     status_.set_status(URLRequestStatus::SUCCESS);
     status_.set_os_error(0);
-  }
-
-  DLOG(INFO) << "OnStopBinding received for request id: " << id();
-
-  // Release these variables after reporting EndRequest since we might need to
-  // access their state.
-  binding_.Release();
-  if (bind_context_) {
-    ::RevokeBindStatusCallback(bind_context_, this);
-    bind_context_.Release();
+    ReleaseBindings();
   }
 
   return S_OK;
 }
 
 STDMETHODIMP UrlmonUrlRequest::GetBindInfo(DWORD* bind_flags,
     BINDINFO *bind_info) {
   DCHECK(worker_thread_ != NULL);
   DCHECK_EQ(PlatformThread::CurrentId(), worker_thread_->thread_id());
 
@@ skipping 379 matching lines @@
       if (status >= 300 && status < 400) {
         redirect_status_ = status;  // store the latest redirect status value.
         status_.set_os_error(net::ERR_UNSAFE_REDIRECT);
       }
     }
     OnResponseEnd(status_);
   } else {
     ignore_redirect_stop_binding_error_ = false;
   }
 
+  ReleaseBindings();
   // Remove the request mapping and release the outstanding reference to us in
   // the context of the UI thread.
+  // We should not access any members of the UrlmonUrlRequest object after this
+  // as the object would be deleted.
   PostTask(FROM_HERE,
            NewRunnableMethod(this, &UrlmonUrlRequest::EndRequestInternal));
 }
 
 void UrlmonUrlRequest::EndRequestInternal() {
   // The request object could have been removed from the map in the
   // OnRequestEnd callback which executes on receiving the
   // AutomationMsg_RequestEnd IPC from Chrome.
   request_handler()->RemoveRequest(this);
   // The current instance could get destroyed in the context of DestroyWindow.
@@ skipping 57 matching lines @@
   hr = info->QueryInfo(HTTP_QUERY_RAW_HEADERS_CRLF, buffer.get(),
                        &size, &flags, &reserved);
   if (FAILED(hr)) {
     DLOG(WARNING) << "Failed to query HTTP headers. Error 0x%x" << hr;
     return std::string();
   }
 
   return buffer.get();
 }
 
+void UrlmonUrlRequest::ReleaseBindings() {
+  binding_.Release();
+  if (bind_context_) {
+    ::RevokeBindStatusCallback(bind_context_, this);
+    bind_context_.Release();
+  }
+}
+
 //
 // UrlmonUrlRequest::Cache implementation.
 //
 
 size_t UrlmonUrlRequest::Cache::Size() {
   size_t size = 0;
   if (stream_) {
     STATSTG cache_stat = {0};
     stream_->Stat(&cache_stat, STATFLAG_NONAME);
 
@@ skipping 150 matching lines @@
       ret = net::ERR_ACCESS_DENIED;
       break;
 
     default:
       DLOG(WARNING)
           << StringPrintf("TODO: translate HRESULT 0x%08X to net::Error", hr);
       break;
   }
   return ret;
 }