[Sync] Fix a subtle use-after-free in Attachments.

sync/internal_api/attachments/attachment_downloader_impl.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sync/internal_api/public/attachments/attachment_downloader_impl.h"
 
 #include <stdint.h>
 #include <utility>
 
 #include "base/base64.h"
@@ skipping 120 matching lines @@
   access_token_request_.reset();
   StateList::const_iterator iter;
   // Without access token all downloads fail.
   for (iter = requests_waiting_for_access_token_.begin();
        iter != requests_waiting_for_access_token_.end();
        ++iter) {
     DownloadState* download_state = *iter;
     scoped_refptr<base::RefCountedString> null_attachment_data;
     ReportResult(*download_state, DOWNLOAD_TRANSIENT_ERROR,
                  null_attachment_data);
-    DCHECK(state_map_.find(download_state->attachment_url) != state_map_.end());
-    state_map_.erase(download_state->attachment_url);
+    // Don't delete using the URL directly to avoid an access after free error
+    // due to std::unordered_map's implementation. See crbug.com/603275.
+    auto erase_iter = state_map_.find(download_state->attachment_url);
+    DCHECK(erase_iter != state_map_.end());
+    state_map_.erase(erase_iter);
   }
   requests_waiting_for_access_token_.clear();
 }
 
 void AttachmentDownloaderImpl::OnURLFetchComplete(
     const net::URLFetcher* source) {
   DCHECK(CalledOnValidThread());
 
   // Find DownloadState by url.
   AttachmentUrl url = source->GetOriginalURL().spec();
@@ skipping 129 matching lines @@
 
   if (crc32c_raw.size() != sizeof(*crc32c))
     return false;
 
   *crc32c =
       base::NetToHost32(*reinterpret_cast<const uint32_t*>(crc32c_raw.c_str()));
   return true;
 }
 
 }  // namespace syncer