Fix a use-after-free in ProfileDownloader.

chrome/browser/profiles/profile_downloader.cc

Index: chrome/browser/profiles/profile_downloader.cc
diff --git a/chrome/browser/profiles/profile_downloader.cc b/chrome/browser/profiles/profile_downloader.cc
index 04f052c2177cc557cc165533fce0b7e24cf5056c..4eb0c33e2cf203c7fcdf2754335f4c162cfe6f5a 100644
--- a/chrome/browser/profiles/profile_downloader.cc
+++ b/chrome/browser/profiles/profile_downloader.cc
@@ -229,10 +229,14 @@ void ProfileDownloader::StartFetchingImage() {
         ->FetchUserInfoBeforeSignin(account_id_);
   }
 
-  if (account_info_.IsValid())
+  if (account_info_.IsValid()) {
+    // FetchImageData might call the delegate's OnProfileDownloadSuccess
+    // synchronously, causing |this| to be deleted so there should not be more
+    // code after it.
     FetchImageData();
-  else
+  } else {
     waiting_for_account_info_ = true;
+  }
 }
 
 void ProfileDownloader::StartFetchingOAuth2AccessToken() {
@@ -385,8 +389,11 @@ void ProfileDownloader::OnAccountUpdated(const AccountInfo& info) {
     // If the StartFetchingImage was called before we had valid info, the
     // downloader has been waiting so we need to fetch the image data now.
     if (waiting_for_account_info_) {
-      FetchImageData();
       waiting_for_account_info_ = false;
+      // FetchImageData might call the delegate's OnProfileDownloadSuccess
+      // synchronously, causing |this| to be deleted so there should not be more
+      // code after it.
+      FetchImageData();
     }
   }
 }