Fix a Use-after-free bug

chrome/browser/download/download_target_determiner.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/download/download_target_determiner.h"
 
 #include "base/location.h"
 #include "base/rand_util.h"
 #include "base/single_thread_task_runner.h"
 #include "base/strings/stringprintf.h"
@@ skipping 306 matching lines @@
 
 void DownloadTargetDeterminer::ReserveVirtualPathDone(
     const base::FilePath& path, bool verified) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   DVLOG(20) << "Reserved path: " << path.AsUTF8Unsafe()
             << " Verified:" << verified;
   DCHECK_EQ(STATE_PROMPT_USER_FOR_DOWNLOAD_PATH, next_state_);
 #if BUILDFLAG(ANDROID_JAVA_UI)
   if (!verified) {
     if (path.empty()) {
-      CancelOnFailureAndDeleteSelf();
       DownloadManagerService::OnDownloadCanceled(
           download_, DownloadController::CANCEL_REASON_NO_EXTERNAL_STORAGE);
+      CancelOnFailureAndDeleteSelf();
       return;
     }
     if (!download_->GetWebContents()) {
       // If we cannot reserve the path and the WebContent is already gone, there
       // is no way to prompt user for an infobar. This could happen after chrome
       // gets killed, and user tries to resume a download while another app has
       // created the target file (not the temporary .crdownload file).
-      CancelOnFailureAndDeleteSelf();
       DownloadManagerService::OnDownloadCanceled(
           download_,
           DownloadController::CANCEL_REASON_CANNOT_DETERMINE_DOWNLOAD_TARGET);
+      CancelOnFailureAndDeleteSelf();
       return;
     }
   }
 #endif
   should_prompt_ = (should_prompt_ || !verified);
   virtual_path_ = path;
   DoLoop();
 }
 
 DownloadTargetDeterminer::Result
@@ skipping 595 matching lines @@
     const base::FilePath& suggested_path) {
   return base::FilePath(suggested_path.value() + kCrdownloadSuffix);
 }
 
 #if defined(OS_WIN)
 // static
 bool DownloadTargetDeterminer::IsAdobeReaderUpToDate() {
   return g_is_adobe_reader_up_to_date_;
 }
 #endif