Fix leak of callback object in r86518.

chrome/browser/download/download_history.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/download/download_history.h"
 
 #include "base/logging.h"
 #include "chrome/browser/history/download_history_info.h"
 #include "chrome/browser/history/history_marshaling.h"
 #include "chrome/browser/download/download_item.h"
 #include "chrome/browser/profiles/profile.h"
 
 // Our download table ID starts at 1, so we use 0 to represent a download that
 // has started, but has not yet had its data persisted in the table. We use fake
 // database handles in incognito mode starting at -1 and progressively getting
 // more negative.
 // static
 const int DownloadHistory::kUninitializedHandle = 0;
 
 DownloadHistory::DownloadHistory(Profile* profile)
     : profile_(profile),
       next_fake_db_handle_(kUninitializedHandle - 1) {
   DCHECK(profile);
 }
 
 DownloadHistory::~DownloadHistory() {
+  // For any outstanding requests to HistoryService::GetVisitCountToHost(),
+  // since they'll be cancelled and thus not call back to
+  // OnGotVisitCountToHost(), we need to delete the associated
+  // VisitedBeforeDoneCallbacks.
+  for (VisitedBeforeRequestsMap::iterator i(visited_before_requests_.begin());
+       i != visited_before_requests_.end(); ++i)
+    delete i->second.second;
 }
 
 void DownloadHistory::Load(HistoryService::DownloadQueryCallback* callback) {
   DCHECK(callback);
   HistoryService* hs = profile_->GetHistoryService(Profile::EXPLICIT_ACCESS);
   if (!hs) {
     delete callback;
     return;
   }
   hs->QueryDownloads(&history_consumer_, callback);
@@ skipping 12 matching lines @@
     HistoryService* hs = profile_->GetHistoryService(Profile::EXPLICIT_ACCESS);
     if (hs) {
       HistoryService::Handle handle = hs->GetVisitCountToHost(referrer_url,
           &history_consumer_,
           NewCallback(this, &DownloadHistory::OnGotVisitCountToHost));
       visited_before_requests_[handle] = std::make_pair(download_id, callback);
       return;
     }
   }
   callback->Run(download_id, false);
+  delete callback;
 }
 
 void DownloadHistory::AddEntry(
     DownloadItem* download_item,
     HistoryService::DownloadCreateCallback* callback) {
   DCHECK(download_item);
   // Do not store the download in the history database for a few special cases:
   // - incognito mode (that is the point of this mode)
   // - extensions (users don't think of extension installation as 'downloading')
   // - temporary download, like in drag-and-drop
@@ skipping 69 matching lines @@
                                             int count,
                                             base::Time first_visit) {
   VisitedBeforeRequestsMap::iterator request =
       visited_before_requests_.find(handle);
   DCHECK(request != visited_before_requests_.end());
   int32 download_id = request->second.first;
   VisitedBeforeDoneCallback* callback = request->second.second;
   visited_before_requests_.erase(request);
   callback->Run(download_id, found_visits && count &&
       (first_visit.LocalMidnight() < base::Time::Now().LocalMidnight()));
+  delete callback;
 }