Fix a use-after-free error in WaitOrCountBookmarks

chrome/browser/profiles/profile_statistics_aggregator.cc

Index: chrome/browser/profiles/profile_statistics_aggregator.cc
diff --git a/chrome/browser/profiles/profile_statistics_aggregator.cc b/chrome/browser/profiles/profile_statistics_aggregator.cc
index 1335d0149c96c832cc9bdd06db01159cd962be60..519dcc79e57e614a513e81bc2221b79ff2222d37 100644
--- a/chrome/browser/profiles/profile_statistics_aggregator.cc
+++ b/chrome/browser/profiles/profile_statistics_aggregator.cc
@@ -197,7 +197,10 @@ void ProfileStatisticsAggregator::WaitOrCountBookmarks() {
   if (bookmark_model) {
     if (bookmark_model->loaded()) {
       CountBookmarks(bookmark_model);
-    } else {
+    } else if (!bookmark_model_helper_) {
+      // If |bookmark_model_helper_| is not null, it means a previous bookmark
+      // counting task still waiting for the bookmark model to load. Do nothing
+      // and continue to use the old |bookmark_model_helper_| in this case.
       AddRef();
       bookmark_model_helper_.reset(new BookmarkModelHelper(this));
       bookmark_model->AddObserver(bookmark_model_helper_.get());