Fix use-after-free that resulted from r106949.

chrome/browser/metrics/metrics_service.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 //------------------------------------------------------------------------------
 // Description of the life cycle of a instance of MetricsService.
 //
 //  OVERVIEW
 //
 // A MetricsService instance is typically created at application startup.  It
@@ skipping 1054 matching lines @@
     default:
       NOTREACHED();
       return "Unknown";
   }
 }
 
 void MetricsService::OnURLFetchComplete(const content::URLFetcher* source) {
   DCHECK(waiting_for_asynchronus_reporting_step_);
   waiting_for_asynchronus_reporting_step_ = false;
   DCHECK(current_fetch_.get());
-  current_fetch_.reset(NULL);  // We're not allowed to re-use it.
+  // We're not allowed to re-use it. Delete it on function exit since we use it.
+  scoped_ptr<content::URLFetcher> s(current_fetch_.release());
 
   // Confirm send so that we can move on.
   VLOG(1) << "METRICS RESPONSE CODE: " << source->GetResponseCode()
           << " status=" << StatusToString(source->GetStatus());
 
   bool upload_succeeded = source->GetResponseCode() == 200;
 
   // Provide boolean for error recovery (allow us to ignore response_code).
   bool discard_log = false;
 
@@ skipping 455 matching lines @@
   if (local_state) {
     const PrefService::Preference* uma_pref =
         local_state->FindPreference(prefs::kMetricsReportingEnabled);
     if (uma_pref) {
       bool success = uma_pref->GetValue()->GetAsBoolean(&result);
       DCHECK(success);
     }
   }
   return result;
 }