Fix a crasher when shutting down with a pending dangerous download

chrome/browser/download/download_manager.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <time.h>
 
 #include "chrome/browser/download/download_manager.h"
 
 #include "base/file_util.h"
 #include "base/logging.h"
@@ skipping 340 matching lines @@
   // 'dangerous_finished_' contains all complete downloads that have not been
   // approved.  They should be removed.
   it = dangerous_finished_.begin();
   for (; it != dangerous_finished_.end(); ++it)
     to_remove.insert(it->second);
 
   // Remove the dangerous download that are not approved.
   for (std::set<DownloadItem*>::const_iterator rm_it = to_remove.begin();
        rm_it != to_remove.end(); ++rm_it) {
     DownloadItem* download = *rm_it;
+    int64 handle = download->db_handle();
     download->Remove(true);
-    // Same as above, delete the download if it is not in 'downloads_'.
-    if (download->db_handle() == kUninitializedHandle)
+    // Same as above, delete the download if it is not in 'downloads_' (as the
+    // Remove() call above won't have deleted it).
+    if (handle == kUninitializedHandle)
       delete download;
   }
   to_remove.clear();
 
   in_progress_.clear();
   dangerous_finished_.clear();
   STLDeleteValues(&downloads_);
 
   file_manager_ = NULL;
 
@@ skipping 901 matching lines @@
   for (std::vector<int64>::iterator it = results->begin();
        it != results->end(); ++it) {
     DownloadMap::iterator dit = downloads_.find(*it);
     if (dit != downloads_.end())
       searched_downloads.push_back(dit->second);
   }
 
   requestor->SetDownloads(searched_downloads);
 }