[Extensions] Fix use-after-free in the developer private API.

chrome/browser/extensions/api/developer_private/extension_info_generator.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/api/developer_private/extension_info_generator.h"
 
 #include "base/base64.h"
 #include "base/strings/utf_string_conversions.h"
 #include "chrome/browser/extensions/api/developer_private/inspectable_views_finder.h"
 #include "chrome/browser/extensions/api/extension_action/extension_action_api.h"
@@ skipping 490 matching lines @@
 void ExtensionInfoGenerator::OnImageLoaded(
     scoped_ptr<developer::ExtensionInfo> info,
     const gfx::Image& icon) {
   info->icon_url = GetIconUrlFromImage(
       icon, info->state != developer::EXTENSION_STATE_ENABLED);
   list_.push_back(make_linked_ptr(info.release()));
 
   --pending_image_loads_;
 
   if (pending_image_loads_ == 0) {  // All done!
-    // We assign to a temporary and Reset() so that at the end of the method,
-    // any stored refs are destroyed.
+    // We assign to a temporary callback and list and reset the stored values so
+    // that at the end of the method, any stored refs are destroyed.
+    ExtensionInfoList list;
+    list.swap(list_);
     ExtensionInfosCallback callback = callback_;
     callback_.Reset();
-    callback.Run(list_);
-    list_.clear();
+    callback.Run(list);  // WARNING: |this| is possibly deleted after this line!
   }
 }
 
 }  // namespace extensions