Modified extensions::StorageInfoProvider::CheckWatchedStorages() to avoid dereferencing an invalid …

chrome/browser/extensions/api/system_info_storage/storage_info_provider.cc

Index: chrome/browser/extensions/api/system_info_storage/storage_info_provider.cc
diff --git a/chrome/browser/extensions/api/system_info_storage/storage_info_provider.cc b/chrome/browser/extensions/api/system_info_storage/storage_info_provider.cc
index ce65d14a1f8fc533920c736f253f1bfcbb8f03b2..991042f4ebade21ad474f3c3ff534e62d236b6e8 100644
--- a/chrome/browser/extensions/api/system_info_storage/storage_info_provider.cc
+++ b/chrome/browser/extensions/api/system_info_storage/storage_info_provider.cc
@@ -102,18 +102,12 @@ void StorageInfoProvider::CheckWatchedStorages() {
 
 void StorageInfoProvider::CheckWatchedStoragesOnBlockingPool() {
   DCHECK(BrowserThread::GetBlockingPool()->RunsTasksOnCurrentThread());
-
-  StorageIDToSizeMap::iterator it = storage_id_to_size_map_.begin();
-  for (; it != storage_id_to_size_map_.end(); ++it) {
+  for (StorageIDToSizeMap::iterator it = storage_id_to_size_map_.begin();
+       it != storage_id_to_size_map_.end(); ) {
     StorageUnitInfo info;
     if (!QueryUnitInfo(it->first, &info)) {
-      storage_id_to_size_map_.erase(it);
-      if (storage_id_to_size_map_.size() == 0) {
-        BrowserThread::PostTask(BrowserThread::UI, FROM_HERE,
-            base::Bind(&StorageInfoProvider::StopWatchingTimerOnUIThread,
-                       this));
-        return;
-      }
+      storage_id_to_size_map_.erase(it++);
+      continue;
     }
     if (it->second != info.available_capacity) {
       observers_->Notify(&Observer::OnStorageFreeSpaceChanged,
@@ -122,8 +116,16 @@ void StorageInfoProvider::CheckWatchedStoragesOnBlockingPool() {
                          info.available_capacity /* new value */);
       it->second = info.available_capacity;
     }
+    ++it;
   }
 
+  if (storage_id_to_size_map_.size() == 0) {

[Hongbo Min, 2013/01/04 02:37:49]

Pls move this code block right after line 109, otherwise, it should have no
chance to get running.

[kmadhusu, 2013/01/04 02:45:18]

This code will run as expected. Why do you think it should be within the for
loop? To me, the new code is easier to read and understand.

[Hongbo Min, 2013/01/04 02:49:25]

You are right. I was thinking it is in for loop scope. 

+    BrowserThread::PostTask(
+        BrowserThread::UI, FROM_HERE,
+        base::Bind(&StorageInfoProvider::StopWatchingTimerOnUIThread,
+                   this));
+    return;
+  }
   OnCheckWatchedStoragesFinishedForTesting();
 }