Fix crashes when a request is aborted during initialization (see issue …

…chromiumembedded#2622).

Initialization of request objects requires asynchronous hops between the UI and
IO threads. In some cases the browser may be destroyed, the mojo connection may
be aborted, or the ProxyURLLoaderFactory object may be deleted while
initialization is still in progress. This change fixes crashes and adds unit
tests that try to reproduce these conditions.

To test: Run `ceftests --gtest_repeat=50
              --gtest_filter=ResourceRequestHandlerTest.Basic*Abort*`

libcef/browser/net_service/proxy_url_loader_factory.cc

@@ -40,7 +40,14 @@ class ResourceContextData : public base::SupportsUserData::Data {
     CEF_REQUIRE_UIT();
 
     content::WebContents* web_contents = web_contents_getter.Run();
-    DCHECK(web_contents);
+
+    // Maybe the browser was destroyed while AddProxyOnUIThread was pending.
+    if (!web_contents) {
+      // Delete on the IO thread as expected by mojo bindings.
+      content::BrowserThread::DeleteSoon(content::BrowserThread::IO, FROM_HERE,
+                                         proxy);
+      return;
+    }
 
     content::BrowserContext* browser_context =
         web_contents->GetBrowserContext();
@@ -1033,7 +1040,9 @@ ProxyURLLoaderFactory::ProxyURLLoaderFactory(
     url_loader_header_client_binding_.Bind(std::move(header_client_request));
 }
 
-ProxyURLLoaderFactory::~ProxyURLLoaderFactory() {}
+ProxyURLLoaderFactory::~ProxyURLLoaderFactory() {
+  CEF_REQUIRE_IOT();
+}
 
 // static
 void ProxyURLLoaderFactory::CreateOnIOThread(