Fix a crash caused by a race condition between the time the UrlmonUrlRequest:...

chrome_frame/urlmon_url_request.h

Index: chrome_frame/urlmon_url_request.h
===================================================================
--- chrome_frame/urlmon_url_request.h	(revision 33288)
+++ chrome_frame/urlmon_url_request.h	(working copy)
@@ -119,6 +119,7 @@
   void StartAsync();
   void StopAsync();
   void ReadAsync(int bytes_to_read);
+  void ReleaseBindings();
 
   static const size_t kCopyChunkSize = 32 * 1024;
   // URL requests are handled on this thread.
@@ -236,6 +237,10 @@
   };
 
   HRESULT StartAsyncDownload();
+  // Sends over the response end notification to chrome, releases the bindings
+  // and releases the initial reference on the UrlmonUrlRequest object.
+  // After this function is called we should not attempt to access any members
+  // as the object could become invalid at any point.
   void EndRequest();
   // Executes in the context of the UI thread and releases the outstanding
   // reference to us. It also deletes the request mapping for this instance.