Fix a crash in URLFetcherCore by handling a case where |request_| is NULL

net/url_request/url_fetcher_core.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/url_request/url_fetcher_core.h"
 
 #include "base/bind.h"
 #include "base/logging.h"
 #include "base/metrics/histogram.h"
 #include "base/single_thread_task_runner.h"
@@ skipping 808 matching lines @@
         FROM_HERE,
         base::Bind(&URLFetcherCore::InformDelegateFetchIsComplete, this));
     return;
   }
 
   // Continue writing.
   data->DidConsume(result);
   if (WriteBuffer(data) < 0)
     return;
 
-  // Finished writing buffer_. Read some more.
+  // Finished writing buffer_. Read some more, unless the request has been
+  // cancelled and deleted.
   DCHECK_EQ(0, data->BytesRemaining());
-  ReadResponse();
+  if (request_.get())
+    ReadResponse();
 }
 
 void URLFetcherCore::ReadResponse() {
   // Some servers may treat HEAD requests as GET requests.  To free up the
   // network connection as soon as possible, signal that the request has
   // completed immediately, without trying to read any data back (all we care
   // about is the response code and headers, which we already have).
   int bytes_read = 0;
   if (request_->status().is_success() &&
       (request_type_ != URLFetcher::HEAD))
@@ skipping 41 matching lines @@
 }
 
 void URLFetcherCore::InformDelegateDownloadProgressInDelegateThread(
     int64 current, int64 total) {
   DCHECK(delegate_task_runner_->BelongsToCurrentThread());
   if (delegate_)
     delegate_->OnURLFetchDownloadProgress(fetcher_, current, total);
 }
 
 }  // namespace net