Fix a memory error writing to a deleted URLFetcher instance.

BUG=40505
TEST=existing test under valgrind.
Review URL: http://codereview.chromium.org/1589028

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@44175 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 10 insertions, 3 deletions

diff --git a/chrome/browser/net/url_fetcher.cc b/chrome/browser/net/url_fetcher.cc
index 350dd50..0d1fbac 100644
--- a/chrome/browser/net/url_fetcher.cc
+++ b/chrome/browser/net/url_fetcher.cc
@@ -156,6 +156,7 @@ void URLFetcher::Core::Start() {
 void URLFetcher::Core::Stop() {
   DCHECK_EQ(MessageLoop::current(), delegate_loop_);
   delegate_ = NULL;
+  fetcher_ = NULL;
   ChromeThread::PostTask(
       ChromeThread::IO, FROM_HERE,
       NewRunnableMethod(this, &Core::CancelURLRequest));
@@ -278,7 +279,10 @@ void URLFetcher::Core::OnCompletedURLRequest(const URLRequestStatus& status) {
     // after backoff time.
     int64 back_off_time =
         protect_entry_->UpdateBackoff(URLFetcherProtectEntry::FAILURE);
-    fetcher_->backoff_delay_ = base::TimeDelta::FromMilliseconds(back_off_time);
+    if (delegate_) {
+      fetcher_->backoff_delay_ =
+          base::TimeDelta::FromMilliseconds(back_off_time);
+    }
     ++num_retries_;
     // Restarts the request if we still need to notify the delegate.
     if (delegate_) {
@@ -293,11 +297,12 @@ void URLFetcher::Core::OnCompletedURLRequest(const URLRequestStatus& status) {
       }
     }
   } else {
-    fetcher_->backoff_delay_ = base::TimeDelta();
     protect_entry_->UpdateBackoff(URLFetcherProtectEntry::SUCCESS);
-    if (delegate_)
+    if (delegate_) {
+      fetcher_->backoff_delay_ = base::TimeDelta();
       delegate_->OnURLFetchComplete(fetcher_, url_, status, response_code_,
                                     cookies_, data_);
+    }
   }
 }
 
diff --git a/chrome/browser/net/url_fetcher_unittest.cc b/chrome/browser/net/url_fetcher_unittest.cc
index 079bad5..6136c7e 100644
--- a/chrome/browser/net/url_fetcher_unittest.cc
+++ b/chrome/browser/net/url_fetcher_unittest.cc
@@ -18,6 +18,8 @@
 using base::Time;
 using base::TimeDelta;
 
+// TODO(eroman): Add a regression test for http://crbug.com/40505.
+
 namespace {
 
 const wchar_t kDocRoot[] = L"chrome/test/data";