Fix a use-after-free in ProfileDownloader.

chrome/browser/profiles/profile_downloader.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/profiles/profile_downloader.h"
 
 #include <string>
 #include <vector>
 
 #include "base/json/json_reader.h"
@@ skipping 211 matching lines @@
 
 void ProfileDownloader::StartFetchingImage() {
   VLOG(1) << "Fetching user entry with token: " << auth_token_;
   account_info_ = account_tracker_service_->GetAccountInfo(account_id_);
 
   if (delegate_->IsPreSignin()) {
     AccountFetcherServiceFactory::GetForProfile(delegate_->GetBrowserProfile())
         ->FetchUserInfoBeforeSignin(account_id_);
   }
 
-  if (account_info_.IsValid())
+  if (account_info_.IsValid()) {
+    // FetchImageData might call the delegate's OnProfileDownloadSuccess
+    // synchronously, causing |this| to be deleted so there should not be more
+    // code after it.
     FetchImageData();
-  else
+  } else {
     waiting_for_account_info_ = true;
+  }
 }
 
 void ProfileDownloader::StartFetchingOAuth2AccessToken() {
   Profile* profile = delegate_->GetBrowserProfile();
   OAuth2TokenService::ScopeSet scopes;
   scopes.insert(GaiaConstants::kGoogleUserInfoProfile);
   // Increase scope to get hd attribute to determine if lock should be enabled.
   if (switches::IsNewProfileManagement())
     scopes.insert(GaiaConstants::kGoogleUserInfoEmail);
   ProfileOAuth2TokenService* token_service =
@@ skipping 132 matching lines @@
       this, ProfileDownloaderDelegate::TOKEN_ERROR);
 }
 
 void ProfileDownloader::OnAccountUpdated(const AccountInfo& info) {
   if (info.account_id == account_id_ && info.IsValid()) {
     account_info_ = info;
 
     // If the StartFetchingImage was called before we had valid info, the
     // downloader has been waiting so we need to fetch the image data now.
     if (waiting_for_account_info_) {
+      waiting_for_account_info_ = false;
+      // FetchImageData might call the delegate's OnProfileDownloadSuccess
+      // synchronously, causing |this| to be deleted so there should not be more
+      // code after it.
       FetchImageData();
-      waiting_for_account_info_ = false;
     }
   }
 }