Make sure that the LoadLog does not get freed on the worker thread during request cancellation.

BUG=22272
TEST=must pass existing tests when running with TSAN.

Review URL: http://codereview.chromium.org/214025

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@26610 0039d316-1c4b-4281-b951-d872f2087c98

net/base/host_resolver_impl.cc

@@ -73,6 +73,9 @@ class HostResolverImpl::Request {
     job_ = NULL;
     callback_ = NULL;
     addresses_ = NULL;
+    // Clear the LoadLog to make sure it won't be released later on the
+    // worker thread. See http://crbug.com/22272
+    load_log_ = NULL;
   }
 
   bool was_cancelled() const {
@@ -187,10 +190,8 @@ class HostResolverImpl::Job
       origin_loop_ = NULL;
     }
 
-    // We don't have to do anything further to actually cancel the requests
-    // that were attached to this job (since they are unreachable now).
-    // But we will call HostResolverImpl::CancelRequest(Request*) on each one
-    // in order to notify any observers.
+    // We will call HostResolverImpl::CancelRequest(Request*) on each one
+    // in order to notify any observers, and also clear the LoadLog.
     for (RequestsList::const_iterator it = requests_.begin();
          it != requests_.end(); ++it) {
       HostResolverImpl::Request* req = *it;
@@ -395,9 +396,11 @@ void HostResolverImpl::CancelRequest(RequestHandle req_handle) {
   Request* req = reinterpret_cast<Request*>(req_handle);
   DCHECK(req);
   DCHECK(req->job());
+  // Hold a reference to the request's load log as we are about to clear it.
+  scoped_refptr<LoadLog> load_log(req->load_log());
   // NULL out the fields of req, to mark it as cancelled.
   req->MarkAsCancelled();
-  OnCancelRequest(req->load_log(), req->id(), req->info());
+  OnCancelRequest(load_log, req->id(), req->info());
 }
 
 void HostResolverImpl::AddObserver(Observer* observer) {