Fix a crash when canceling a save page operation.

chrome/browser/download/save_package.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/download/save_package.h"
 
 #include "base/file_util.h"
 #include "base/logging.h"
 #include "base/message_loop.h"
 #include "base/path_service.h"
@@ skipping 98 matching lines @@
 
   return pure_file_name.substr(0, l_paren_index);
 }
 
 }  // namespace
 
 SavePackage::SavePackage(WebContents* web_content,
                          SavePackageType save_type,
                          const FilePath& file_full_path,
                          const FilePath& directory_full_path)
-    : web_contents_(web_content),
+    : file_manager_(NULL),
+      web_contents_(web_content),
       download_(NULL),
       saved_main_file_path_(file_full_path),
       saved_main_directory_path_(directory_full_path),
       finished_(false),
       user_canceled_(false),
       disk_error_occurred_(false),
       save_type_(save_type),
       all_save_items_count_(0),
       wait_state_(INITIALIZE),
       tab_id_(web_content->process()->pid()) {
   DCHECK(web_content);
   const GURL& current_page_url = web_contents_->GetURL();
   DCHECK(current_page_url.is_valid());
   page_url_ = current_page_url;
   DCHECK(save_type_ == SAVE_AS_ONLY_HTML ||
          save_type_ == SAVE_AS_COMPLETE_HTML);
   DCHECK(!saved_main_file_path_.empty() &&
          saved_main_file_path_.value().length() <= kMaxFilePathLength);
   DCHECK(!saved_main_directory_path_.empty() &&
          saved_main_directory_path_.value().length() < kMaxFilePathLength);
 }
 
 SavePackage::SavePackage(WebContents* web_contents)
-    : web_contents_(web_contents),
+    : file_manager_(NULL),
+      web_contents_(web_contents),
       download_(NULL),
       finished_(false),
       user_canceled_(false),
       disk_error_occurred_(false),
       all_save_items_count_(0),
       wait_state_(INITIALIZE),
       tab_id_(web_contents->process()->pid()) {
   const GURL& current_page_url = web_contents_->GetURL();
   DCHECK(current_page_url.is_valid());
   page_url_ = current_page_url;
 }
 
 // This is for testing use. Set |finished_| as true because we don't want
 // method Cancel to be be called in destructor in test mode.
 SavePackage::SavePackage(const FilePath& file_full_path,
                          const FilePath& directory_full_path)
-    : download_(NULL),
+    : file_manager_(NULL),
+      download_(NULL),
       saved_main_file_path_(file_full_path),
       saved_main_directory_path_(directory_full_path),
       finished_(true),
       user_canceled_(false),
       disk_error_occurred_(false),
       all_save_items_count_(0),
       tab_id_(0) {
   DCHECK(!saved_main_file_path_.empty() &&
          saved_main_file_path_.value().length() <= kMaxFilePathLength);
   DCHECK(!saved_main_directory_path_.empty() &&
@@ skipping 329 matching lines @@
   if (!write_success) {
     // Cancel job with reason of disk error.
     Cancel(false);
   }
   return true;
 }
 
 // Stop all page saving jobs that are in progress and instruct the file thread
 // to delete all saved  files.
 void SavePackage::Stop() {
+  // If we haven't moved out of the initial state, there's nothing to cancel and
+  // there won't be valid pointers for file_manager_ or download_.
+  if (wait_state_ == INITIALIZE)
+    return;
+
   // When stopping, if it still has some items in in_progress, cancel them.
   DCHECK(canceled());
   if (in_process_count()) {
     SaveUrlItemMap::iterator it = in_progress_items_.begin();
     for (; it != in_progress_items_.end(); ++it) {
       SaveItem* save_item = it->second;
       DCHECK(save_item->state() == SaveItem::IN_PROGRESS);
       save_item->Cancel();
     }
     // Remove all in progress item to saved map. For failed items, they will
@@ skipping 618 matching lines @@
                                int index, void* params) {
   SavePackageParam* save_params = reinterpret_cast<SavePackageParam*>(params);
   ContinueSave(save_params, path, index);
   delete save_params;
 }
 
 void SavePackage::FileSelectionCanceled(void* params) {
   SavePackageParam* save_params = reinterpret_cast<SavePackageParam*>(params);
   delete save_params;
 }