Cronet UrlRequest onAppendChunk now checks that request is not destroyed.

components/cronet/android/url_request_adapter.cc

Index: components/cronet/android/url_request_adapter.cc
diff --git a/components/cronet/android/url_request_adapter.cc b/components/cronet/android/url_request_adapter.cc
index 8b2df90773dc35ff4143381d5f13b9132d908b38..5d8f84965fc9c59dc616399aa77d4637234728f8 100644
--- a/components/cronet/android/url_request_adapter.cc
+++ b/components/cronet/android/url_request_adapter.cc
@@ -126,6 +126,13 @@ void URLRequestAdapter::Start() {
 void URLRequestAdapter::OnAppendChunk(const scoped_ptr<char[]> bytes,
                                       int bytes_len, bool is_last_chunk) {
   DCHECK(OnNetworkThread());
+  // Request could have completed and been destroyed on the network thread
+  // while appendChunk was posting the task from an application thread.
+  if (!url_request_) {
+    VLOG(1) << "Cannot append chunk to destroyed request: "
+            << url_.possibly_invalid_spec().c_str();
+    return;
+  }
   url_request_->AppendChunkToUpload(bytes.get(), bytes_len, is_last_chunk);
 }