Delete downloads after updating observers.

The download page adds itself as an observer to in-progress
and unconfirmed dangerous downloads, and removes itself when
the download manager indicates its state has changed.

This caused a crash when the downloads were deleted during a
"clear browsing data" operation, since the delete happened
before the download page was notified of a download manager
state change. The download page then attempted to remove itself
from a deleted item.

BUG=9444 (http://crbug.com/9444)

Review URL: http://codereview.chromium.org/56096

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@12874 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 7 insertions, 3 deletions

diff --git a/chrome/browser/download/download_manager.cc b/chrome/browser/download/download_manager.cc
index 1e6eeda..f58307c 100644
--- a/chrome/browser/download/download_manager.cc
+++ b/chrome/browser/download/download_manager.cc
@@ -1017,8 +1017,8 @@ int DownloadManager::RemoveDownloadsBetween(const base::Time remove_begin,
                                             const base::Time remove_end) {
   RemoveDownloadsFromHistoryBetween(remove_begin, remove_end);
 
-  int num_deleted = 0;
   DownloadMap::iterator it = downloads_.begin();
+  std::vector<DownloadItem*> pending_deletes;
   while (it != downloads_.end()) {
     DownloadItem* download = it->second;
     DownloadItem::DownloadState state = download->state();
@@ -1034,9 +1034,8 @@ int DownloadManager::RemoveDownloadsBetween(const base::Time remove_begin,
       if (dit != dangerous_finished_.end())
         dangerous_finished_.erase(dit);
 
-      delete download;
+      pending_deletes.push_back(download);
 
-      ++num_deleted;
       continue;
     }
 
@@ -1044,9 +1043,14 @@ int DownloadManager::RemoveDownloadsBetween(const base::Time remove_begin,
   }
 
   // Tell observers to refresh their views.
+  int num_deleted = static_cast<int>(pending_deletes.size());
   if (num_deleted > 0)
     FOR_EACH_OBSERVER(Observer, observers_, ModelChanged());
 
+  // Delete the download items after updating the observers.
+  STLDeleteContainerPointers(pending_deletes.begin(), pending_deletes.end());
+  pending_deletes.clear();
+
   return num_deleted;
 }