Fix crash when switching to a profile that cannot be opened

chrome/browser/profiles/profile_manager.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/profiles/profile_manager.h"
 
 #include <stdint.h>
 
 #include <set>
 #include <string>
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/deferred_sequenced_task_runner.h"
 #include "base/feature_list.h"
 #include "base/files/file_enumerator.h"
 #include "base/files/file_path.h"
 #include "base/files/file_util.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
+#include "base/threading/sequenced_task_runner_handle.h"
 #include "base/trace_event/trace_event.h"
 #include "build/build_config.h"
 #include "chrome/browser/bookmarks/bookmark_model_factory.h"
 #include "chrome/browser/bookmarks/startup_task_runner_service_factory.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/chrome_notification_types.h"
 #include "chrome/browser/content_settings/host_content_settings_map_factory.h"
 #include "chrome/browser/download/download_service.h"
 #include "chrome/browser/download/download_service_factory.h"
 #include "chrome/browser/invalidation/profile_invalidation_provider_factory.h"
@@ skipping 1063 matching lines @@
   if (success && !go_off_the_record)
     RunCallbacks(callbacks, profile, Profile::CREATE_STATUS_CREATED);
 
   // Perform initialization.
   if (success) {
     DoFinalInit(profile, go_off_the_record);
     if (go_off_the_record)
       profile = profile->GetOffTheRecordProfile();
     info->created = true;
   } else {
-    profile = NULL;
+    profile = nullptr;
+    // Unmap the profile from |profiles_info_|. Delete the profile
+    // asynchronously because it may be referenced in some asynchronous tasks.
+    base::SequencedTaskRunnerHandle::Get()->DeleteSoon(FROM_HERE,
+                                                       info->profile.release());
     profiles_info_.erase(iter);
     // TODO(yiyaoliu): This is temporary, remove it after it's not used.
     UMA_HISTOGRAM_COUNTS_100("UMA.ProfilesCount.AfterErase",
                              profiles_info_.size());
   }
 
   if (profile) {
     // If this was the guest or system profile, finish setting its special
     // status.
     if (profile->IsGuestSession() || profile->IsSystemProfile())
@@ skipping 392 matching lines @@
 }
 
 ProfileManager::ProfileInfo::ProfileInfo(
     Profile* profile,
     bool created)
     : profile(profile),
       created(created) {
 }
 
 ProfileManager::ProfileInfo::~ProfileInfo() {
-  ProfileDestroyer::DestroyProfileWhenAppropriate(profile.release());
+  if (profile)
+    ProfileDestroyer::DestroyProfileWhenAppropriate(profile.release());
 }
 
 #if !defined(OS_ANDROID)
 void ProfileManager::UpdateLastUser(Profile* last_active) {
   PrefService* local_state = g_browser_process->local_state();
   DCHECK(local_state);
   // Only keep track of profiles that we are managing; tests may create others.
   // Also never consider the SystemProfile as "active".
   if (profiles_info_.find(last_active->GetPath()) != profiles_info_.end() &&
       !last_active->IsSystemProfile()) {
@@ skipping 102 matching lines @@
 
   FinishDeletingProfile(profile_to_delete_path, new_active_profile_path);
   if (!original_callback.is_null())
     original_callback.Run(loaded_profile, status);
 }
 #endif  // !defined(OS_ANDROID)
 
 ProfileManagerWithoutInit::ProfileManagerWithoutInit(
     const base::FilePath& user_data_dir) : ProfileManager(user_data_dir) {
 }