Search Engines: Fix crash in TemplateURLService::UpdateProviderFavicons

Previously we could crash, because within this method, we iterate over
a collection and update its elements, and subsequently invalidate the
very collection we are iterating over.

This CL fixes it. pbos@ provided the diagnosis.

Bug: 846406
Change-Id: Ibeadddfaef2e7a3700b9b9fae6143892aee10af1
Reviewed-on: https://chromium-review.googlesource.com/1072189Reviewed-by: Peter Kasting <pkasting@chromium.org>
Commit-Queue: Tommy Li <tommycli@chromium.org>
Cr-Commit-Position: refs/heads/master@{#561646}

components/search_engines/template_url_service.cc

@@ -594,8 +594,12 @@ void TemplateURLService::UpdateProviderFavicons(
   if (!urls_for_host)
     return;
 
+  // Make a copy of the container of the matching TemplateURLs, as the original
+  // container is invalidated as we update the contained TemplateURLs.
+  TemplateURLSet urls_for_host_copy(*urls_for_host);
+
   Scoper scoper(this);
-  for (TemplateURL* turl : *urls_for_host) {
+  for (TemplateURL* turl : urls_for_host_copy) {
     if (!IsCreatedByExtension(turl) &&
         turl->IsSearchURL(potential_search_url, search_terms_data()) &&
         turl->favicon_url() != favicon_url) {