Disk Cache: If there are no abort_callbacks, we should not

call DoAbortCallbacks because the SparseControl object may be
gone already (after calling DoUserCallback).

BUG= 96479
TEST=none (asan should be happy).
Review URL: http://codereview.chromium.org/7919021

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@101587 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 8 insertions, 2 deletions

diff --git a/net/disk_cache/sparse_control.cc b/net/disk_cache/sparse_control.cc
index 9e1ac9c..3043d2b 100644
--- a/net/disk_cache/sparse_control.cc
+++ b/net/disk_cache/sparse_control.cc
@@ -673,7 +673,7 @@ void SparseControl::DoChildrenIO() {
       entry_->net_log().EndEvent(GetSparseEventType(operation_), NULL);
     }
     if (pending_)
-      DoUserCallback();
+      DoUserCallback();  // Don't touch this object after this point.
   }
 }
 
@@ -819,8 +819,14 @@ void SparseControl::OnChildIOCompleted(int result) {
       entry_->net_log().AddEvent(net::NetLog::TYPE_CANCELLED, NULL);
       entry_->net_log().EndEvent(GetSparseEventType(operation_), NULL);
     }
+    // We have an indirect reference to this object for every callback so if
+    // there is only one callback, we may delete this object before reaching
+    // DoAbortCallbacks.
+    bool has_abort_callbacks = !abort_callbacks_.empty();
     DoUserCallback();
-    return DoAbortCallbacks();
+    if (has_abort_callbacks)
+      DoAbortCallbacks();
+    return;
   }
 
   // We are running a callback from the message loop. It's time to restart what