Fix a crash caused by a race condition between the time the UrlmonUrlRequest:...

chrome_frame/urlmon_url_request.cc

Index: chrome_frame/urlmon_url_request.cc
===================================================================
--- chrome_frame/urlmon_url_request.cc	(revision 33288)
+++ chrome_frame/urlmon_url_request.cc	(working copy)
@@ -315,18 +315,9 @@
   } else {
     status_.set_status(URLRequestStatus::SUCCESS);
     status_.set_os_error(0);
+    ReleaseBindings();
   }
 
-  DLOG(INFO) << "OnStopBinding received for request id: " << id();
-
-  // Release these variables after reporting EndRequest since we might need to
-  // access their state.
-  binding_.Release();
-  if (bind_context_) {
-    ::RevokeBindStatusCallback(bind_context_, this);
-    bind_context_.Release();
-  }
-
   return S_OK;
 }
 
@@ -724,8 +715,11 @@
     ignore_redirect_stop_binding_error_ = false;
   }
 
+  ReleaseBindings();
   // Remove the request mapping and release the outstanding reference to us in
   // the context of the UI thread.
+  // We should not access any members of the UrlmonUrlRequest object after this
+  // as the object would be deleted.
   PostTask(FROM_HERE,
            NewRunnableMethod(this, &UrlmonUrlRequest::EndRequestInternal));
 }
@@ -803,6 +797,14 @@
   return buffer.get();
 }
 
+void UrlmonUrlRequest::ReleaseBindings() {
+  binding_.Release();
+  if (bind_context_) {
+    ::RevokeBindStatusCallback(bind_context_, this);
+    bind_context_.Release();
+  }
+}
+
 //
 // UrlmonUrlRequest::Cache implementation.
 //