The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/2813991c65e09a65de095074c867e88af557088e

commit 2813991c65e09a65de095074c867e88af557088e
Author: lukasza <lukasza@chromium.org>
Date: Tue Mar 22 15:54:53 2016

Fix how Save-Page-As responds to web requests blocked by extensions.

AdBlocker extensions exercise (via chrome.webRequest API) a code path
where ResourceHandler (and in particular SaveFileResourceHandler)
reports a failure via OnResponseCompleted without first calling
OnResponseStarted.  This code path is also executed when the request
fails before HTTP headers are received and parsed (i.e. if the host name
could not be resolved by DNS).

In this code path, SaveFileManager::SaveFinished is called before
SaveFileManager::StartSave got called.  This means that when
SaveFinished calls LookupSaveFile, it won't find anything.  This
behavior has regressed in https://crrev.com/1484093002, which removed
the "else" clause in SaveFinished method, incorrectly thinking that
save_item_id-based lookup will always succeed because of the other
changes made in the CL.

This CL fixes the problem by always calling OnSaveFinished (even if
LookupSaveFile failed).  To make this work, we need to make sure that
SavePackage lookup in SaveFinished succeeds, even if OnStartSave was not
called (this is where |package_| map was populated before the fix).  To
accomplish this, the fix moves populating the |package_| map (SaveItemId
to SavePackage* map) earlier - from OnStartSave into SaveURL method.

BUG= 595345 

Review URL: https://codereview.chromium.org/1812693002

Cr-Commit-Position: refs/heads/master@{#382577}

[modify] https://crrev.com/2813991c65e09a65de095074c867e88af557088e/content/browser/download/save_file_manager.cc
[modify] https://crrev.com/2813991c65e09a65de095074c867e88af557088e/content/browser/download/save_file_manager.h
[modify] https://crrev.com/2813991c65e09a65de095074c867e88af557088e/content/browser/download/save_package.cc

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/d19c1443dccf9bc0b2cd7b6e9afc2b080e95cd02

commit d19c1443dccf9bc0b2cd7b6e9afc2b080e95cd02
Author: lukasza <lukasza@chromium.org>
Date: Tue Mar 22 22:56:59 2016

Regression test for handling early failure during network download.

The test would cause a hang/timeout before the fix in crrev.com/1812693002.

BUG= 594219 ,  595345 

Review URL: https://codereview.chromium.org/1820363002

Cr-Commit-Position: refs/heads/master@{#382718}

[modify] https://crrev.com/d19c1443dccf9bc0b2cd7b6e9afc2b080e95cd02/chrome/browser/download/save_page_browsertest.cc
[modify] https://crrev.com/d19c1443dccf9bc0b2cd7b6e9afc2b080e95cd02/chrome/test/data/save_page/broken-image.htm

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/c9bda843237953f3ebba5e6a3234bcc96421df48

commit c9bda843237953f3ebba5e6a3234bcc96421df48
Author: Lukasz Anforowicz <lukasza@chromium.org>
Date: Wed Mar 23 22:15:53 2016

Fix how Save-Page-As responds to web requests blocked by extensions.

AdBlocker extensions exercise (via chrome.webRequest API) a code path
where ResourceHandler (and in particular SaveFileResourceHandler)
reports a failure via OnResponseCompleted without first calling
OnResponseStarted.  This code path is also executed when the request
fails before HTTP headers are received and parsed (i.e. if the host name
could not be resolved by DNS).

In this code path, SaveFileManager::SaveFinished is called before
SaveFileManager::StartSave got called.  This means that when
SaveFinished calls LookupSaveFile, it won't find anything.  This
behavior has regressed in https://crrev.com/1484093002, which removed
the "else" clause in SaveFinished method, incorrectly thinking that
save_item_id-based lookup will always succeed because of the other
changes made in the CL.

This CL fixes the problem by always calling OnSaveFinished (even if
LookupSaveFile failed).  To make this work, we need to make sure that
SavePackage lookup in SaveFinished succeeds, even if OnStartSave was not
called (this is where |package_| map was populated before the fix).  To
accomplish this, the fix moves populating the |package_| map (SaveItemId
to SavePackage* map) earlier - from OnStartSave into SaveURL method.

BUG= 595345 

Review URL: https://codereview.chromium.org/1812693002

Cr-Commit-Position: refs/heads/master@{#382577}
(cherry picked from commit 2813991c65e09a65de095074c867e88af557088e)

Review URL: https://codereview.chromium.org/1829893003 .

Cr-Commit-Position: refs/branch-heads/2661@{#367}
Cr-Branched-From: ef6f6ae5e4c96622286b563658d5cd62a6cf1197-refs/heads/master@{#378081}

[modify] https://crrev.com/c9bda843237953f3ebba5e6a3234bcc96421df48/content/browser/download/save_file_manager.cc
[modify] https://crrev.com/c9bda843237953f3ebba5e6a3234bcc96421df48/content/browser/download/save_file_manager.h
[modify] https://crrev.com/c9bda843237953f3ebba5e6a3234bcc96421df48/content/browser/download/save_package.cc