1 files changed, 14 insertions, 3 deletions

diff --git a/chrome_frame/urlmon_url_request.cc b/chrome_frame/urlmon_url_request.cc
index 1c71edb..560f4b8 100644
--- a/chrome_frame/urlmon_url_request.cc
+++ b/chrome_frame/urlmon_url_request.cc
@@ -46,13 +46,14 @@ bool UrlmonUrlRequest::Start() {
     return false;
   }
 
-  worker_thread_->message_loop()->PostTask(
-      FROM_HERE, NewRunnableMethod(this, &UrlmonUrlRequest::StartAsync));
-
   // Take a self reference to maintain COM lifetime. This will be released
   // in EndRequest
   AddRef();
   request_handler()->AddRequest(this);
+
+  worker_thread_->message_loop()->PostTask(
+      FROM_HERE, NewRunnableMethod(this, &UrlmonUrlRequest::StartAsync));
+
   return true;
 }
 
@@ -64,6 +65,11 @@ void UrlmonUrlRequest::Stop() {
     return;
   }
 
+  // We can remove the request from the map safely here if it is still valid.
+  // There is an additional reference on the UrlmonUrlRequest instance which
+  // is released when the task scheduled by the EndRequest function executes.
+  request_handler()->RemoveRequest(this);
+
   worker_thread_->message_loop()->PostTask(
       FROM_HERE, NewRunnableMethod(this, &UrlmonUrlRequest::StopAsync));
 }
@@ -205,6 +211,8 @@ STDMETHODIMP UrlmonUrlRequest::OnStopBinding(HRESULT result, LPCWSTR error) {
     status_.set_os_error(0);
   }
 
+  DLOG(INFO) << "OnStopBinding received for request id: " << id();
+
   // Release these variables after reporting EndRequest since we might need to
   // access their state.
   binding_ = NULL;
@@ -605,6 +613,9 @@ void UrlmonUrlRequest::EndRequest() {
 }
 
 void UrlmonUrlRequest::EndRequestInternal() {
+  // The request object could have been removed from the map in the
+  // OnRequestEnd callback which executes on receiving the
+  // AutomationMsg_RequestEnd IPC from Chrome.
   request_handler()->RemoveRequest(this);
   // Release the outstanding reference in the context of the UI thread to
   // ensure that our instance gets deleted in the same thread which created it.