Protect against touching download after observation has been stopped.

content/browser/download/save_package.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/download/save_package.h"
 
 #include <algorithm>
 
 #include "base/bind.h"
 #include "base/file_path.h"
@@ skipping 729 matching lines @@
   for (SaveUrlItemMap::iterator it = saved_failed_items_.begin();
        it != saved_failed_items_.end(); ++it)
     save_ids.push_back(it->second->save_id());
 
   BrowserThread::PostTask(
       BrowserThread::FILE, FROM_HERE,
       base::Bind(&SaveFileManager::RemoveSavedFileFromFileMap,
                  file_manager_,
                  save_ids));
 
-  // Hack to avoid touching download_ after user cancel.
-  // TODO(rdsmith/benjhayden): Integrate canceling on DownloadItem
-  // with SavePackage flow.
-  if (download_ && download_->IsInProgress()) {
-    if (save_type_ != content::SAVE_PAGE_TYPE_AS_MHTML) {
-      download_->OnAllDataSaved(all_save_items_count_,
-                                DownloadItem::kEmptyFileHash);
+  if (download_) {
+    // Hack to avoid touching download_ after user cancel.
+    // TODO(rdsmith/benjhayden): Integrate canceling on DownloadItem
+    // with SavePackage flow.
+    if (download_->IsInProgress()) {
+      if (save_type_ != content::SAVE_PAGE_TYPE_AS_MHTML) {
+        download_->OnAllDataSaved(all_save_items_count_,
+                                  DownloadItem::kEmptyFileHash);
+      }
+      download_->MarkAsComplete();
     }
-    download_->MarkAsComplete();
+    FinalizeDownloadEntry();
   }
-  FinalizeDownloadEntry();
 }
 
 // Called for updating end state.
 void SavePackage::SaveFinished(int32 save_id, int64 size, bool is_success) {
   // Because we might have canceled this saving job before,
   // so we might not find corresponding SaveItem. Just ignore it.
   SaveItem* save_item = LookupItemInProcessBySaveId(save_id);
   if (!save_item)
     return;
 
@@ skipping 620 matching lines @@
       // central SavePackage related location that observers can
       // get to if they want to wait for notifications for a
       // particular BrowserContext.  Alternatively, we could make
       // it come from the WebContents, which would be more specific
       // but less useful to (current) customers.
       content::Source<content::DownloadManager>(download_manager_),
       content::Details<content::DownloadItem>(download_));
   download_manager_->SavePageDownloadFinished(download_);
   StopObservation();
 }