Fix a use-after-free error in WaitOrCountBookmarks

chrome/browser/profiles/profile_statistics_aggregator.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/profiles/profile_statistics_aggregator.h"
 
 #include <stddef.h>
 
 #include "base/bind.h"
 #include "base/macros.h"
@@ skipping 179 matching lines @@
     return;
   if (!g_browser_process->profile_manager()->IsValidProfile(profile_))
     return;
 
   bookmarks::BookmarkModel* bookmark_model =
       BookmarkModelFactory::GetForProfileIfExists(profile_);
 
   if (bookmark_model) {
     if (bookmark_model->loaded()) {
       CountBookmarks(bookmark_model);
-    } else {
+    } else if (!bookmark_model_helper_) {
+      // If |bookmark_model_helper_| is not null, it means a previous bookmark
+      // counting task still waiting for the bookmark model to load. Do nothing
+      // and continue to use the old |bookmark_model_helper_| in this case.
       AddRef();
       bookmark_model_helper_.reset(new BookmarkModelHelper(this));
       bookmark_model->AddObserver(bookmark_model_helper_.get());
     }
   } else {
     StatisticsCallbackFailure(profiles::kProfileStatisticsBookmarks);
   }
 }
 
 ProfileStatisticsAggregator::ProfileStatValue
@@ skipping 18 matching lines @@
     }
 
     result.count = count;
     result.success = true;
   } else {
     result.count = 0;
     result.success = false;
   }
   return result;
 }