Fix memory leak in WebRequestProxyingURLLoaderFactory

The error handling in WebRequestProxyingURLLoaderFactory was causing
some objects not to be destroyed. This now uses a pattern similar to
signin::ProxyingURLLoaderFactory.

Bug: 888707
Change-Id: I033bd11c4281b238cebeb7924cc334a0264ff3b4
Reviewed-on: https://chromium-review.googlesource.com/1242297Reviewed-by: Ken Rockot <rockot@chromium.org>
Commit-Queue: Clark DuVall <cduvall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#593995}

extensions/browser/api/web_request/web_request_proxying_url_loader_factory.cc

@@ -677,18 +677,17 @@ WebRequestProxyingURLLoaderFactory::~WebRequestProxyingURLLoaderFactory() =
 void WebRequestProxyingURLLoaderFactory::OnTargetFactoryError() {
   DCHECK_CURRENTLY_ON(content::BrowserThread::IO);
   target_factory_.reset();
-  if (proxy_bindings_.empty()) {
-    // Deletes |this|.
-    proxies_->RemoveProxy(this);
-  }
+  proxy_bindings_.CloseAllBindings();
+
+  MaybeRemoveProxy();
 }
 
 void WebRequestProxyingURLLoaderFactory::OnProxyBindingError() {
   DCHECK_CURRENTLY_ON(content::BrowserThread::IO);
-  if (proxy_bindings_.empty() && !target_factory_.is_bound()) {
-    // Deletes |this|.
-    proxies_->RemoveProxy(this);
-  }
+  if (proxy_bindings_.empty())
+    target_factory_.reset();
+
+  MaybeRemoveProxy();
 }
 
 void WebRequestProxyingURLLoaderFactory::RemoveRequest(
@@ -701,6 +700,18 @@ void WebRequestProxyingURLLoaderFactory::RemoveRequest(
         this, content::GlobalRequestID(render_process_id_,
                                        network_service_request_id));
   }
+
+  MaybeRemoveProxy();
+}
+
+void WebRequestProxyingURLLoaderFactory::MaybeRemoveProxy() {
+  // Even if all URLLoaderFactory pipes connected to this object have been
+  // closed it has to stay alive until all active requests have completed.
+  if (target_factory_.is_bound() || !requests_.empty())
+    return;
+
+  // Deletes |this|.
+  proxies_->RemoveProxy(this);
 }
 
 }  // namespace extensions

extensions/browser/api/web_request/web_request_proxying_url_loader_factory.h

@@ -193,6 +193,7 @@ class WebRequestProxyingURLLoaderFactory
   void OnTargetFactoryError();
   void OnProxyBindingError();
   void RemoveRequest(int32_t network_service_request_id, uint64_t request_id);
+  void MaybeRemoveProxy();
 
   void* const browser_context_;
   content::ResourceContext* const resource_context_;