Fix a crash caused by a race condition between the time the UrlmonUrlRequest:...

chrome_frame/urlmon_url_request.h

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_FRAME_URLMON_URL_REQUEST_H_
 #define CHROME_FRAME_URLMON_URL_REQUEST_H_
 
 #include <urlmon.h>
 #include <atlbase.h>
 #include <atlcom.h>
@@ skipping 101 matching lines @@
   }
 
   virtual void OnFinalMessage(HWND window);
 
  protected:
   // The following functions issue and handle Urlmon requests on the dedicated
   // Urlmon thread.
   void StartAsync();
   void StopAsync();
   void ReadAsync(int bytes_to_read);
+  void ReleaseBindings();
 
   static const size_t kCopyChunkSize = 32 * 1024;
   // URL requests are handled on this thread.
   base::Thread* worker_thread_;
 
   // A fake stream class to make it easier to copy received data using
   // IStream::CopyTo instead of allocating temporary buffers and keeping
   // track of data copied so far.
   class SendStream
       : public CComObjectRoot,
@@ skipping 97 matching lines @@
     bool is_valid() const {
       return (stream_ != NULL);
     }
 
    protected:
     ScopedComPtr<IStream> stream_;
     char read_buffer_[kCopyChunkSize];
   };
 
   HRESULT StartAsyncDownload();
+  // Sends over the response end notification to chrome, releases the bindings
+  // and releases the initial reference on the UrlmonUrlRequest object.
+  // After this function is called we should not attempt to access any members
+  // as the object could become invalid at any point.
   void EndRequest();
   // Executes in the context of the UI thread and releases the outstanding
   // reference to us. It also deletes the request mapping for this instance.
   void EndRequestInternal();
   int GetHttpResponseStatus() const;
   std::string GetHttpHeaders() const;
 
   static net::Error HresultToNetError(HRESULT hr);
 
  private:
@@ skipping 10 matching lines @@
   static int instance_count_;
   HWND parent_window_;
   // Set to true if a redirect notification was aborted.
   bool ignore_redirect_stop_binding_error_;
 
   DISALLOW_COPY_AND_ASSIGN(UrlmonUrlRequest);
 };
 
 #endif  // CHROME_FRAME_URLMON_URL_REQUEST_H_