Fix a crash in URLFetcherCore by handling a case where |request_| is NULL

net/url_request/url_fetcher_core.cc

Index: net/url_request/url_fetcher_core.cc
diff --git a/net/url_request/url_fetcher_core.cc b/net/url_request/url_fetcher_core.cc
index bd28b4b0161af2c205a3c2cd1766fbc15ef5ab3d..ab0f37911b75c48097aff500afa3e290a1dad87a 100644
--- a/net/url_request/url_fetcher_core.cc
+++ b/net/url_request/url_fetcher_core.cc
@@ -826,9 +826,11 @@ void URLFetcherCore::DidWriteBuffer(scoped_refptr<DrainableIOBuffer> data,
   if (WriteBuffer(data) < 0)
     return;
 
-  // Finished writing buffer_. Read some more.
+  // Finished writing buffer_. Read some more, unless the request has been
+  // cancelled and deleted.
   DCHECK_EQ(0, data->BytesRemaining());
-  ReadResponse();
+  if (request_.get())
+    ReadResponse();
 }
 
 void URLFetcherCore::ReadResponse() {