Update from https://crrev.com/307330

net/http/disk_cache_based_quic_server_info.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/disk_cache_based_quic_server_info.h"
 
 #include "base/bind.h"
 #include "base/callback.h"
 #include "base/callback_helpers.h"
 #include "base/logging.h"
@@ skipping 182 matching lines @@
                                                 int rv) {
   // TODO(vadimt): Remove ScopedTracker below once crbug.com/422516 is fixed.
   tracked_objects::ScopedTracker tracking_profile(
       FROM_HERE_WITH_EXPLICIT_FUNCTION(
           "422516 DiskCacheBasedQuicServerInfo::OnIOComplete"));
 
   DCHECK_NE(NONE, state_);
   rv = DoLoop(rv);
   if (rv == ERR_IO_PENDING)
     return;
+
+  base::WeakPtr<DiskCacheBasedQuicServerInfo> weak_this =
+      weak_factory_.GetWeakPtr();
+
   if (!wait_for_ready_callback_.is_null()) {
     wait_for_data_end_time_ = base::TimeTicks::Now();
     RecordLastFailure();
     base::ResetAndReturn(&wait_for_ready_callback_).Run(rv);
   }
-  if (ready_ && !pending_write_data_.empty()) {
+  // |wait_for_ready_callback_| could delete the object if there is an error.
+  // Check if |weak_this| still exists before accessing it.
+  if (weak_this.get() && ready_ && !pending_write_data_.empty()) {
     DCHECK_EQ(NONE, state_);
     PersistInternal();
   }
 }
 
 int DiskCacheBasedQuicServerInfo::DoLoop(int rv) {
   do {
     switch (state_) {
       case GET_BACKEND:
         rv = DoGetBackend();
@@ skipping 264 matching lines @@
   } else if (backend_->GetCacheType() == net::MEMORY_CACHE) {
     UMA_HISTOGRAM_ENUMERATION("Net.QuicDiskCache.FailureReason.MemoryCache",
                               failure, NUM_OF_FAILURES);
   } else {
     UMA_HISTOGRAM_ENUMERATION("Net.QuicDiskCache.FailureReason.DiskCache",
                               failure, NUM_OF_FAILURES);
   }
 }
 
 }  // namespace net