Fix a crash in URLFetcherCore by handling a case where |request_| is NULL

net/url_request/url_fetcher_core.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/url_request/url_fetcher_core.h"
 
 #include "base/bind.h"
 #include "base/logging.h"
 #include "base/metrics/histogram.h"
 #include "base/single_thread_task_runner.h"
@@ skipping 814 matching lines @@
   data->DidConsume(result);
   if (WriteBuffer(data) < 0)
     return;
 
   // Finished writing buffer_. Read some more.
   DCHECK_EQ(0, data->BytesRemaining());
   ReadResponse();
 }
 
 void URLFetcherCore::ReadResponse() {
+  if (!request_.get())
+    return;

[mmenke, 2013/10/31 18:14:18]

I'd really like to just delete the writer on cancellation - the writer does
nominally support deletion while a request is pending, but I believe there's
another bug in that case - It would work if it had a SequencedTaskRunner.  We
also currently never reset the writer, which makes me a little nervous about
that option.

So...  I think it's OK to check the request instead, but if we go that route,
I'd rather it be in URLFetcherCore::DidWriteBuffer.

[droger, 2013/11/04 15:38:04]

Done.

   // Some servers may treat HEAD requests as GET requests.  To free up the
   // network connection as soon as possible, signal that the request has
   // completed immediately, without trying to read any data back (all we care
   // about is the response code and headers, which we already have).
   int bytes_read = 0;
   if (request_->status().is_success() &&
       (request_type_ != URLFetcher::HEAD))
     request_->Read(buffer_.get(), kBufferSize, &bytes_read);
   OnReadCompleted(request_.get(), bytes_read);
 }
@@ skipping 38 matching lines @@
 }
 
 void URLFetcherCore::InformDelegateDownloadProgressInDelegateThread(
     int64 current, int64 total) {
   DCHECK(delegate_task_runner_->BelongsToCurrentThread());
   if (delegate_)
     delegate_->OnURLFetchDownloadProgress(fetcher_, current, total);
 }
 
 }  // namespace net