Check Expect-CT preflight success before accessing response code

While adding Expect-CT support for chrome://net-internals, I noticed that a
crash can occur if the report URL results in a net error. This appears to be due
to accessing the response code before checking the request status is
success. Unfortunately, I can't reproduce the crash in a browser or unit test,
perhaps because it's a race.

Bug: 751197
Change-Id: I60c2b4debe19da9ef98f838ce2013747644a39d8
Reviewed-on: https://chromium-review.googlesource.com/596514Reviewed-by: Mustafa Emre Acer <meacer@chromium.org>
Commit-Queue: Emily Stark <estark@chromium.org>
Cr-Commit-Position: refs/heads/master@{#491161}

chrome/browser/ssl/chrome_expect_ct_reporter.cc

@@ -208,7 +208,8 @@ void ChromeExpectCTReporter::OnResponseStarted(net::URLRequest* request,
   DCHECK(inflight_preflights_.end() != inflight_preflights_.find(request));
   PreflightInProgress* preflight = preflight_it->second.get();
 
-  const int response_code = request->GetResponseCode();
+  const int response_code =
+      request->status().is_success() ? request->GetResponseCode() : -1;
 
   // Check that the preflight succeeded: it must have an HTTP OK status code,
   // with the following headers:
@@ -216,10 +217,9 @@ void ChromeExpectCTReporter::OnResponseStarted(net::URLRequest* request,
   // - Access-Control-Allow-Methods: POST
   // - Access-Control-Allow-Headers: Content-Type
 
-  if (!request->status().is_success() || response_code < 200 ||
-      response_code > 299) {
+  if (response_code == -1 || response_code < 200 || response_code > 299) {
     RecordUMAOnFailure(preflight->report_uri, request->status().error(),
-                       request->status().is_success() ? response_code : -1);
+                       response_code);
     inflight_preflights_.erase(request);
     // Do not use |preflight| after this point, since it has been erased above.
     return;