Fix crash when switching to a profile that cannot be opened

chrome/browser/profiles/profile_manager.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This class keeps track of the currently-active profiles in the runtime.
 
 #ifndef CHROME_BROWSER_PROFILES_PROFILE_MANAGER_H_
 #define CHROME_BROWSER_PROFILES_PROFILE_MANAGER_H_
 
 #include <stddef.h>
@@ skipping 383 matching lines @@
 #if !defined(OS_ANDROID)
   BrowserListObserver browser_list_observer_;
 #endif  // !defined(OS_ANDROID)
 
   // Maps profile path to ProfileInfo (if profile has been created). Use
   // RegisterProfile() to add into this map. This map owns all loaded profile
   // objects in a running instance of Chrome.
   typedef std::map<base::FilePath, linked_ptr<ProfileInfo> > ProfilesInfoMap;
   ProfilesInfoMap profiles_info_;
 
+  // Owns profiles that fails initialization. Like normal profiles, they are not

[Peter Kasting, 2016/06/13 04:43:20]

Nit: fail

[WC Leung, 2016/06/13 08:06:45]

Acknowledged.

[WC Leung, 2016/06/15 13:08:39]

Done.

+  // safe to destroy from memory before shutdown.

[Peter Kasting, 2016/06/13 04:43:20]

Nit: "...they must not be deleted before shutdown."

But it would be nice to explain why, since it's not obvious why a failed profile
can't just be deleted.

[WC Leung, 2016/06/13 08:06:45]

Acknowledged.

[WC Leung, 2016/06/15 13:08:39]

Actually some services (e.g. pref store) that Profile is depending on appears to
be creating async tasks that outlives itself. My syzyasan report points to
JSONPrefStore. BTW, I'd rather not having this written in the source code.

Unfortunately I do not have enough understanding of the pref store as a whole,
so I cannot fix it myself.

+  std::vector<std::unique_ptr<Profile>> failed_profiles_;
+
   // Manages the process of creating, deleteing and updating Desktop shortcuts.
   std::unique_ptr<ProfileShortcutManager> profile_shortcut_manager_;
 
   // For keeping track of the last active profiles.
   std::map<Profile*, int> browser_counts_;
   // On startup we launch the active profiles in the order they became active
   // during the last run. This is why they are kept in a list, not in a set.
   std::vector<Profile*> active_profiles_;
   bool closing_all_browsers_;
 
   DISALLOW_COPY_AND_ASSIGN(ProfileManager);
 };
 
 // Same as the ProfileManager, but doesn't initialize some services of the
 // profile. This one is useful in unittests.
 class ProfileManagerWithoutInit : public ProfileManager {
  public:
   explicit ProfileManagerWithoutInit(const base::FilePath& user_data_dir);
 
  protected:
   void DoFinalInitForServices(Profile*, bool) override {}
   void DoFinalInitLogging(Profile*) override {}
 };
 
 #endif  // CHROME_BROWSER_PROFILES_PROFILE_MANAGER_H_