Do not set io_loop_ to NULL until we have deleted request_ and set

request_ to NULL, otherwise Cancel() may fail to post a CancelURLRequest
task because io_loop_ is NULL but request_ is not NULL.  (That task adds
a reference to the OCSPRequestSession object to ensure that it lives
longer than the URLRequest object.)

R=ukai
BUG=28526
TEST=none
Review URL: http://codereview.chromium.org/460040

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@33698 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 3 insertions, 4 deletions

diff --git a/net/ocsp/nss_ocsp.cc b/net/ocsp/nss_ocsp.cc
index a82f141..e48edc10 100644
--- a/net/ocsp/nss_ocsp.cc
+++ b/net/ocsp/nss_ocsp.cc
@@ -216,16 +216,15 @@ class OCSPRequestSession
     } while (request_->Read(buffer_, kRecvBufferSize, &bytes_read));
 
     if (!request_->status().is_io_pending()) {
-      MessageLoop* io_loop = io_loop_;
+      delete request_;
+      request_ = NULL;
+      io_loop_->RemoveDestructionObserver(this);
       {
         AutoLock autolock(lock_);
         finished_ = true;
         io_loop_ = NULL;
       }
       cv_.Signal();
-      delete request_;
-      request_ = NULL;
-      io_loop->RemoveDestructionObserver(this);
     }
   }