Fix crash when switching to a profile that cannot be opened

chrome/browser/profiles/profile_manager.cc

Index: chrome/browser/profiles/profile_manager.cc
diff --git a/chrome/browser/profiles/profile_manager.cc b/chrome/browser/profiles/profile_manager.cc
index 46f22de0686b9eddf7160ae86045d8e8482b3902..a9f2e0c8dbc2412b4d0194a50028ace405182eb2 100644
--- a/chrome/browser/profiles/profile_manager.cc
+++ b/chrome/browser/profiles/profile_manager.cc
@@ -20,6 +20,7 @@
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
+#include "base/threading/sequenced_task_runner_handle.h"
 #include "base/trace_event/trace_event.h"
 #include "build/build_config.h"
 #include "chrome/browser/bookmarks/bookmark_model_factory.h"
@@ -1103,7 +1104,11 @@ void ProfileManager::OnProfileCreated(Profile* profile,
       profile = profile->GetOffTheRecordProfile();
     info->created = true;
   } else {
-    profile = NULL;
+    profile = nullptr;
+    // Unmap the profile from |profiles_info_|. Delete the profile
+    // asynchronously because it may be referenced in some asynchronous tasks.
+    base::SequencedTaskRunnerHandle::Get()->DeleteSoon(FROM_HERE,
+                                                       info->profile.release());
     profiles_info_.erase(iter);
     // TODO(yiyaoliu): This is temporary, remove it after it's not used.
     UMA_HISTOGRAM_COUNTS_100("UMA.ProfilesCount.AfterErase",
@@ -1516,7 +1521,8 @@ ProfileManager::ProfileInfo::ProfileInfo(
 }
 
 ProfileManager::ProfileInfo::~ProfileInfo() {
-  ProfileDestroyer::DestroyProfileWhenAppropriate(profile.release());
+  if (profile)
+    ProfileDestroyer::DestroyProfileWhenAppropriate(profile.release());
 }
 
 #if !defined(OS_ANDROID)