Sync: Fix crash in favicon sync code (using string after free).

chrome/browser/sync/glue/session_model_associator.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/sync/glue/session_model_associator.h"
 
 #include <algorithm>
 #include <set>
 #include <utility>
 
@@ skipping 933 matching lines @@
   }
 }
 
 void SessionModelAssociator::DecrementAndCleanFaviconForURL(
     const std::string& page_url) {
   if (page_url.empty())
     return;
   std::map<std::string, std::string>::const_iterator iter =
       synced_favicon_pages_.find(page_url);
   if (iter != synced_favicon_pages_.end()) {
-    const std::string& favicon_url = iter->second;
+    const std::string favicon_url = iter->second;
     DCHECK_GT(synced_favicons_[favicon_url]->usage_count, 0);
     --(synced_favicons_[favicon_url]->usage_count);
     if (synced_favicons_[favicon_url]->usage_count <= 0) {
       // No more tabs using this favicon. Erase it.
       synced_favicons_.erase(favicon_url);
       // Erase the page mappings to the favicon url. We iterate through all
       // page urls in case multiple pages share the same favicon.
       std::map<std::string, std::string>::iterator page_iter;
       for (page_iter = synced_favicon_pages_.begin();
            page_iter != synced_favicon_pages_.end();) {
@@ skipping 487 matching lines @@
 bool SessionModelAssociator::CryptoReadyIfNecessary() {
   // We only access the cryptographer while holding a transaction.
   sync_api::ReadTransaction trans(FROM_HERE, sync_service_->GetUserShare());
   const syncable::ModelTypeSet encrypted_types =
       sync_api::GetEncryptedTypes(&trans);
   return !encrypted_types.Has(SESSIONS) ||
          sync_service_->IsCryptographerReady(&trans);
 }
 
 }  // namespace browser_sync