Fix shutdown crash in weblayer if there are pending downloads on exit.

Bug: 1025603
Change-Id: I061f50b6666376a9f829dd833c507ce200e31765
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2069853
Commit-Queue: John Abd-El-Malek <jam@chromium.org>
Auto-Submit: John Abd-El-Malek <jam@chromium.org>
Reviewed-by: Scott Violet <sky@chromium.org>
Cr-Commit-Position: refs/heads/master@{#744022}

weblayer/browser/download_browsertest.cc

@@ -328,4 +328,16 @@ IN_PROC_BROWSER_TEST_F(DownloadBrowserTest, NetworkError) {
   EXPECT_EQ(download_state(), DownloadError::kConnectivityError);
 }
 
+IN_PROC_BROWSER_TEST_F(DownloadBrowserTest, PendingOnExist) {
+  // Create a request that doesn't complete right away.
+  GURL url(embedded_test_server()->GetURL(
+      content::SlowDownloadHttpResponse::kKnownSizeUrl));
+
+  shell()->tab()->GetNavigationController()->Navigate(url);
+
+  WaitForStarted();
+
+  // If this test crashes later then there'd be a regression.
+}
+
 }  // namespace weblayer

weblayer/browser/download_manager_delegate_impl.cc

@@ -52,6 +52,11 @@ DownloadManagerDelegateImpl::DownloadManagerDelegateImpl(
 
 DownloadManagerDelegateImpl::~DownloadManagerDelegateImpl() {
   download_manager_->RemoveObserver(this);
+  // Match the AddObserver calls added in OnDownloadCreated to avoid UaF.
+  download::SimpleDownloadManager::DownloadVector downloads;
+  download_manager_->GetAllDownloads(&downloads);
+  for (auto* download : downloads)
+    download->RemoveObserver(this);
 }
 
 bool DownloadManagerDelegateImpl::DetermineDownloadTarget(