Fix a crash due to CHECK() hit in SafeBrowsingResourceHandler.

The problem was the CHECK() doesn't apply when the resource request has been cancelled via the interstitial page -- if you close the tab displaying the warning, the request is cancelled leading to OnResponseCompleted() firing with an error status, so state_ == STATE_DISPLAYING_BLOCKING_PAGE.
Also made sure this code path handles cancellation of any outstanding url check.

BUG=37674
TEST=Open a URL that causes the safe browsing warning page to be display. Now close the tab containing the warning; should not crash.

Review URL: http://codereview.chromium.org/671009

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@40955 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 10 insertions, 2 deletions

diff --git a/chrome/browser/renderer_host/safe_browsing_resource_handler.cc b/chrome/browser/renderer_host/safe_browsing_resource_handler.cc
index 958df73..f8691f0 100644
--- a/chrome/browser/renderer_host/safe_browsing_resource_handler.cc
+++ b/chrome/browser/renderer_host/safe_browsing_resource_handler.cc
@@ -130,12 +130,12 @@ bool SafeBrowsingResourceHandler::OnReadCompleted(int request_id,
 bool SafeBrowsingResourceHandler::OnResponseCompleted(
     int request_id, const URLRequestStatus& status,
     const std::string& security_info) {
-  CHECK(state_ == STATE_NONE);
-  CHECK(defer_state_ == DEFERRED_NONE);
+  Shutdown();
   return next_handler_->OnResponseCompleted(request_id, status, security_info);
 }
 
 void SafeBrowsingResourceHandler::OnRequestClosed() {
+  Shutdown();
   next_handler_->OnRequestClosed();
 }
 
@@ -201,7 +201,12 @@ void SafeBrowsingResourceHandler::Observe(NotificationType type,
                                           const NotificationSource& source,
                                           const NotificationDetails& details) {
   DCHECK(type.value == NotificationType::RESOURCE_MESSAGE_FILTER_SHUTDOWN);
+  Shutdown();
+}
+
+void SafeBrowsingResourceHandler::Shutdown() {
   if (state_ == STATE_CHECKING_URL) {
+    timer_.Stop();
     safe_browsing_->CancelCheck(this);
     state_ = STATE_NONE;
     // Balance the AddRef() from CheckUrl() which would ordinarily be
diff --git a/chrome/browser/renderer_host/safe_browsing_resource_handler.h b/chrome/browser/renderer_host/safe_browsing_resource_handler.h
index e34f74f..b113635 100644
--- a/chrome/browser/renderer_host/safe_browsing_resource_handler.h
+++ b/chrome/browser/renderer_host/safe_browsing_resource_handler.h
@@ -94,6 +94,9 @@ class SafeBrowsingResourceHandler : public ResourceHandler,
 
   ~SafeBrowsingResourceHandler();
 
+  // Cancels any in progress safe browsing actions.
+  void Shutdown();
+
   // Starts running |url| through the safe browsing check. Returns true if the
   // URL is safe to visit. Otherwise returns false and will call
   // OnUrlCheckResult() when the check has completed.