Fix invalid pointer indirection causing crash when syncing data.

chrome/browser/extensions/extension_service.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/extension_service.h"
 
 #include <algorithm>
 #include <set>
 
 #include "base/basictypes.h"
@@ skipping 1482 matching lines @@
 
   // Broadcast unloaded and loaded events to update browser state. Only bother
   // if the value changed and the extension is actually enabled, since there is
   // no UI otherwise.
   bool old_enabled = extension_prefs_->IsIncognitoEnabled(extension_id);
   if (enabled == old_enabled)
     return;
 
   extension_prefs_->SetIsIncognitoEnabled(extension_id, enabled);
 
-  bool extension_is_enabled = extensions_.Contains(extension->id());

[Yoyo Zhou, 2011/12/09 22:01:23]

I believe extension->id() should be extension_id (which is the argument to this
function).

+  bool extension_is_enabled = extension ?
+      extensions_.Contains(extension->id()) : false;
 
   // When we reload the extension the ID may be invalidated if we've passed it
   // by const ref everywhere. Make a copy to be safe.
   std::string id = extension_id;
   if (extension_is_enabled)
     ReloadExtension(extension->id());

[Yoyo Zhou, 2011/12/09 22:01:23]

Same here -- although if we get here then extension must have been valid, it
still seems safer to use extension_id.

 
   // Reloading the extension invalidates the |extension| pointer.
   extension = GetInstalledExtension(id);
   if (extension)
     SyncExtensionChangeIfNeeded(*extension);
 }
 
 void ExtensionService::SetAppNotificationSetupDone(
     const std::string& extension_id,
     const std::string& oauth_client_id) {
@@ skipping 995 matching lines @@
 
 ExtensionService::NaClModuleInfoList::iterator
     ExtensionService::FindNaClModule(const GURL& url) {
   for (NaClModuleInfoList::iterator iter = nacl_module_list_.begin();
        iter != nacl_module_list_.end(); ++iter) {
     if (iter->url == url)
       return iter;
   }
   return nacl_module_list_.end();
 }