Cronet UrlRequest onAppendChunk now checks that request is not destroyed.

components/cronet/android/url_request_adapter.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "url_request_adapter.h"
 
 #include <string.h>
 
 #include "base/bind.h"
 #include "base/location.h"
@@ skipping 108 matching lines @@
 void URLRequestAdapter::Start() {
   context_->PostTaskToNetworkThread(
       FROM_HERE,
       base::Bind(&URLRequestAdapter::OnInitiateConnection,
                  base::Unretained(this)));
 }
 
 void URLRequestAdapter::OnAppendChunk(const scoped_ptr<char[]> bytes,
                                       int bytes_len, bool is_last_chunk) {
   DCHECK(OnNetworkThread());
+  // Request could have completed and been destroyed on the network thread
+  // while appendChunk was posting the task from an application thread.
+  if (!url_request_) {
+    VLOG(1) << "Cannot append chunk to destroyed request: "
+            << url_.possibly_invalid_spec().c_str();
+    return;
+  }
   url_request_->AppendChunkToUpload(bytes.get(), bytes_len, is_last_chunk);
 }
 
 void URLRequestAdapter::OnInitiateConnection() {
   DCHECK(OnNetworkThread());
   if (canceled_) {
     return;
   }
 
   VLOG(1) << "Starting chromium request: "
@@ skipping 198 matching lines @@
 unsigned char* URLRequestAdapter::Data() const {
   DCHECK(OnNetworkThread());
   return reinterpret_cast<unsigned char*>(read_buffer_->StartOfBuffer());
 }
 
 bool URLRequestAdapter::OnNetworkThread() const {
   return context_->GetNetworkTaskRunner()->BelongsToCurrentThread();
 }
 
 }  // namespace cronet