Fix race condition in the navigation_url_loader.

The race condition happens when UrlLoader::OnReceiveResponse() is
received, but the request is canceled in the meantime. In this case, there
are no more request and we must abort the loading.

It fixes the Android test:
android.webkit.cts.WebViewTest#testSetDownloadListener
in the Android compatibility test suite (CTS).

Bug: 828156
Change-Id: I6bd6c2e89ab055f05ddab51b5cddebf4ff93bb47
Reviewed-on: https://chromium-review.googlesource.com/993057
Commit-Queue: John Abd-El-Malek <jam@chromium.org>
Reviewed-by: John Abd-El-Malek <jam@chromium.org>
Cr-Commit-Position: refs/heads/master@{#547798}

content/browser/loader/navigation_url_loader_network_service.cc

@@ -836,6 +836,16 @@ class NavigationURLLoaderNetworkService::URLLoaderRequestController
     } else {
       ResourceDispatcherHostImpl* rdh = ResourceDispatcherHostImpl::Get();
       net::URLRequest* url_request = rdh->GetURLRequest(global_request_id_);
+
+      // The |url_request| maybe have been removed from the resource dispatcher
+      // host during the time it took for OnReceiveResponse() to be received. In
+      // this case, it means the request has been canceled.
+      // See https://crbug.com/828156.
+      if (!url_request) {
+        OnComplete(network::URLLoaderCompletionStatus(net::ERR_ABORTED));
+        return;
+      }
+
       ResourceRequestInfoImpl* info =
           ResourceRequestInfoImpl::ForRequest(url_request);
       is_download = !response_intercepted && info->IsDownload();