Fix a use-after-free in ProfileDownloader.

chrome/browser/profiles/profile_downloader.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/profiles/profile_downloader.h"
 
 #include <string>
 #include <vector>
 
 #include "base/json/json_reader.h"
@@ skipping 212 matching lines @@
 void ProfileDownloader::StartFetchingImage() {
   VLOG(1) << "Fetching user entry with token: " << auth_token_;
   account_info_ = account_tracker_service_->GetAccountInfo(account_id_);
 
   if (delegate_->IsPreSignin()) {
     AccountFetcherServiceFactory::GetForProfile(delegate_->GetBrowserProfile())
         ->FetchUserInfoBeforeSignin(account_id_);
   }
 
   if (account_info_.IsValid())
     FetchImageData();

[Roger Tawa OOO till Jul 10th, 2015/09/14 20:03:02]

Maybe add comment here and at line 389 that this should be last call to member,
since object could get deleted.

Nit: add { and } to if and else blocks.

   else
     waiting_for_account_info_ = true;
 }
 
 void ProfileDownloader::StartFetchingOAuth2AccessToken() {
   Profile* profile = delegate_->GetBrowserProfile();
   OAuth2TokenService::ScopeSet scopes;
   scopes.insert(GaiaConstants::kGoogleUserInfoProfile);
   // Increase scope to get hd attribute to determine if lock should be enabled.
   if (switches::IsNewProfileManagement())
@@ skipping 134 matching lines @@
       this, ProfileDownloaderDelegate::TOKEN_ERROR);
 }
 
 void ProfileDownloader::OnAccountUpdated(const AccountInfo& info) {
   if (info.account_id == account_id_ && info.IsValid()) {
     account_info_ = info;
 
     // If the StartFetchingImage was called before we had valid info, the
     // downloader has been waiting so we need to fetch the image data now.
     if (waiting_for_account_info_) {
+      waiting_for_account_info_ = false;
       FetchImageData();
-      waiting_for_account_info_ = false;
     }
   }
 }