Fix crash if a pending request is continued after deletion (see issue c…

…hromiumembedded#2622).

This is a speculative fix for a crash where the pending ResourceRequest appears
to be invalid after the request is continued from SetInitialized.

libcef/browser/net_service/proxy_url_loader_factory.cc

@@ -875,6 +875,9 @@ void InterceptedRequest::ContinueToResponseStarted(int error_code) {
 }
 
 void InterceptedRequest::OnDestroy() {
+  // We don't want any callbacks after this point.
+  weak_factory_.InvalidateWeakPtrs();
+
   factory_->request_handler_->OnRequestComplete(id_, request_, status_);
 
   // Destroys |this|.

libcef/browser/net_service/resource_request_handler_wrapper.cc

@@ -920,7 +920,19 @@ class InterceptedRequestHandlerWrapper : public InterceptedRequestHandler {
 
     RequestState* state = GetState(id);
     if (!state) {
-      // The request may have been canceled during destruction.
+      // The request may have been aborted during initialization or canceled
+      // during destruction. This method will always be called before a request
+      // is deleted, so if the request is currently pending also remove it from
+      // the list.
+      if (!pending_requests_.empty()) {
+        PendingRequests::iterator it = pending_requests_.begin();
+        for (; it != pending_requests_.end(); ++it) {
+          if ((*it)->id_ == id) {
+            pending_requests_.erase(it);
+            break;
+          }
+        }
+      }
       return;
     }