Fix crashes in DownloadRequestLimiter when extension popups/bubbles initiate downloads automatically

chrome/browser/download/download_request_limiter.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_DOWNLOAD_DOWNLOAD_REQUEST_LIMITER_H_
 #define CHROME_BROWSER_DOWNLOAD_DOWNLOAD_REQUEST_LIMITER_H_
 #pragma once
 
 #include <map>
 #include <string>
 #include <vector>
 
 #include "base/callback.h"
 #include "base/gtest_prod_util.h"
 #include "base/memory/ref_counted.h"
 #include "content/public/browser/notification_observer.h"
 #include "content/public/browser/notification_registrar.h"
 
 class DownloadRequestInfoBarDelegate;
+class DownloadRequestLimiterObserver;
 class TabContentsWrapper;
 
 namespace content {
 class NavigationController;
 class WebContents;
 }
 
 // DownloadRequestLimiter is responsible for determining whether a download
 // should be allowed or not. It is designed to keep pages from downloading
 // multiple files without user interaction. DownloadRequestLimiter is invoked
@@ skipping 187 matching lines @@
   // CanDownloadOnIOThread invokes this on the UI thread. This determines the
   // tab and invokes CanDownloadImpl.
   void CanDownload(int render_process_host_id,
                    int render_view_id,
                    int request_id,
                    const std::string& request_method,
                    const Callback& callback);
 
   // Does the work of updating the download status on the UI thread and
   // potentially prompting the user.
-  void CanDownloadImpl(TabContentsWrapper* originating_tab,
+  void CanDownloadImpl(content::WebContents* originating_contents,
                        int request_id,
                        const std::string& request_method,
                        const Callback& callback);
 
   // Invoked on the UI thread. Schedules a call to NotifyCallback on the io
   // thread.
   void ScheduleNotification(const Callback& callback, bool allow);
 
   // Removes the specified TabDownloadState from the internal map and deletes
   // it. This has the effect of resetting the status for the tab to
   // ALLOW_ONE_DOWNLOAD.
   void Remove(TabDownloadState* state);
 
+  void RemoveObserver(content::WebContents* web_contents,
+                      DownloadRequestLimiterObserver* observer);
+
   // Maps from tab to download state. The download state for a tab only exists
   // if the state is other than ALLOW_ONE_DOWNLOAD. Similarly once the state
   // transitions from anything but ALLOW_ONE_DOWNLOAD back to ALLOW_ONE_DOWNLOAD
   // the TabDownloadState is removed and deleted (by way of Remove).
   typedef std::map<content::NavigationController*, TabDownloadState*> StateMap;
   StateMap state_map_;
 
+  typedef std::map<content::WebContents*, DownloadRequestLimiterObserver*>
+    ObserverMap;
+  ObserverMap observer_map_;
+
   static TestingDelegate* delegate_;
 
   DISALLOW_COPY_AND_ASSIGN(DownloadRequestLimiter);
 };
 
 #endif  // CHROME_BROWSER_DOWNLOAD_DOWNLOAD_REQUEST_LIMITER_H_