Fix a crash in URLFetcherCore by handling a case where |request_| is NULL

This is a speculative fix for the crash:
https://crash-old.corp.google.com/reportdetail?reportid=4897b184b09b23c8#crashing_thread

My hypothesis is that the request is released while there is a pending call to DidWriteBuffer().
The request was maybe released because
- the fetch was stopped or cancelled
- or ReleaseRequest() was called in OnReadCompleted


BUG=308626, 314241

Review URL: https://codereview.chromium.org/46573008

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@232929 0039d316-1c4b-4281-b951-d872f2087c98

net/url_request/url_fetcher_core.cc

@@ -827,9 +827,11 @@ void URLFetcherCore::DidWriteBuffer(scoped_refptr<DrainableIOBuffer> data,
   if (WriteBuffer(data) < 0)
     return;
 
-  // Finished writing buffer_. Read some more.
+  // Finished writing buffer_. Read some more, unless the request has been
+  // cancelled and deleted.
   DCHECK_EQ(0, data->BytesRemaining());
-  ReadResponse();
+  if (request_.get())
+    ReadResponse();
 }
 
 void URLFetcherCore::ReadResponse() {