Fix remove |UrlDownloadHandler| before added.

This will happens when a download was created by
|CreateDownloadHandlerForNavigation| and we will call |OnUrlDownloadStarted| before
|OnUrlDownloadHandlerCreated| due to we had got the
response. Then there is a chance that the
|cancel_request_callback| will called before
|OnUrlDownloadHandlerCreated|. we will fail to cancel this request since
we haven't add it into the |url_download_handlers_|.

Bug:None

Change-Id: Id6a0018a6ac06909ca7c8462a5a90555b61a4873
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2111515
Commit-Queue: Min Qin <qinmin@chromium.org>
Reviewed-by: Min Qin <qinmin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#752323}

components/download/internal/common/in_progress_download_manager.cc

@@ -130,21 +130,15 @@ void CreateDownloadHandlerForNavigation(
     mojo::PendingRemote<device::mojom::WakeLockProvider> wake_lock_provider,
     const scoped_refptr<base::SingleThreadTaskRunner>& main_task_runner) {
   DCHECK(GetIOTaskRunner()->BelongsToCurrentThread());
-  UrlDownloadHandler::UniqueUrlDownloadHandlerPtr downloader(
-      ResourceDownloader::InterceptNavigationResponse(
-          download_manager, std::move(resource_request), render_process_id,
-          render_frame_id, site_url, tab_url, tab_referrer_url,
-          std::move(url_chain), std::move(cert_status),
-          std::move(response_head), std::move(response_body),
-          std::move(url_loader_client_endpoints),
-          network::SharedURLLoaderFactory::Create(
-              std::move(pending_url_loader_factory)),
-          url_security_policy, std::move(wake_lock_provider), main_task_runner)
-          .release(),
-      base::OnTaskRunnerDeleter(base::ThreadTaskRunnerHandle::Get()));
 
-  OnUrlDownloadHandlerCreated(std::move(downloader), download_manager,
-                              main_task_runner);
+  ResourceDownloader::InterceptNavigationResponse(
+      download_manager, std::move(resource_request), render_process_id,
+      render_frame_id, site_url, tab_url, tab_referrer_url,
+      std::move(url_chain), std::move(cert_status), std::move(response_head),
+      std::move(response_body), std::move(url_loader_client_endpoints),
+      network::SharedURLLoaderFactory::Create(
+          std::move(pending_url_loader_factory)),
+      url_security_policy, std::move(wake_lock_provider), main_task_runner);
 }
 
 #if defined(OS_ANDROID)

components/download/internal/common/resource_downloader.cc

@@ -79,8 +79,7 @@ std::unique_ptr<ResourceDownloader> ResourceDownloader::BeginDownload(
 }
 
 // static
-std::unique_ptr<ResourceDownloader>
-ResourceDownloader::InterceptNavigationResponse(
+void ResourceDownloader::InterceptNavigationResponse(
     base::WeakPtr<UrlDownloadHandler::Delegate> delegate,
     std::unique_ptr<network::ResourceRequest> resource_request,
     int render_process_id,
@@ -102,10 +101,17 @@ ResourceDownloader::InterceptNavigationResponse(
       site_url, tab_url, tab_referrer_url, true, task_runner,
       std::move(url_loader_factory), url_security_policy,
       std::move(wake_lock_provider));
-  downloader->InterceptResponse(
+  ResourceDownloader* raw_downloader = downloader.get();
+  task_runner->PostTask(
+      FROM_HERE,
+      base::BindOnce(
+          &UrlDownloadHandler::Delegate::OnUrlDownloadHandlerCreated, delegate,
+          UrlDownloadHandler::UniqueUrlDownloadHandlerPtr(
+              std::move(downloader).release(),
+              base::OnTaskRunnerDeleter(base::ThreadTaskRunnerHandle::Get()))));
+  raw_downloader->InterceptResponse(
       std::move(url_chain), cert_status, std::move(response_head),
       std::move(response_body), std::move(url_loader_client_endpoints));
-  return downloader;
 }
 
 ResourceDownloader::ResourceDownloader(

components/download/internal/common/resource_downloader.h

@@ -44,7 +44,7 @@ class COMPONENTS_DOWNLOAD_EXPORT ResourceDownloader
   // Create a ResourceDownloader from a navigation that turns to be a download.
   // No URLLoader is created, but the URLLoaderClient implementation is
   // transferred.
-  static std::unique_ptr<ResourceDownloader> InterceptNavigationResponse(
+  static void InterceptNavigationResponse(
       base::WeakPtr<UrlDownloadHandler::Delegate> delegate,
       std::unique_ptr<network::ResourceRequest> resource_request,
       int render_process_id,
@@ -168,8 +168,6 @@ class COMPONENTS_DOWNLOAD_EXPORT ResourceDownloader
   // download to be interrupted.
   mojo::Remote<device::mojom::WakeLock> wake_lock_;
 
-  base::WeakPtrFactory<ResourceDownloader> weak_ptr_factory_{this};
-
   DISALLOW_COPY_AND_ASSIGN(ResourceDownloader);
 };