Code: void DownloadItemImpl::OnDownloadCompleting(DownloadFileManager* file_manager) {
  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));

  VLOG(20) << __FUNCTION__ << "()"
           << " needs rename = " << NeedsRename()
           << " " << DebugString(true);
  DCHECK(!GetTargetName().empty());
   DCHECK_NE(DANGEROUS, GetSafetyState());
   DCHECK(file_manager);
 
     bool should_overwrite =
         (GetTargetDisposition() != DownloadItem::TARGET_DISPOSITION_UNIQUIFY);
     DownloadFileManager::RenameCompletionCallback callback =
        base::Bind(&DownloadItemImpl::OnDownloadRenamedToFinalName,
                   weak_ptr_factory_.GetWeakPtr(),
                    base::Unretained(file_manager));
     BrowserThread::PostTask(
         BrowserThread::FILE, FROM_HERE,
        base::Bind(&DownloadFileManager::RenameCompletingDownloadFile,
                    file_manager, GetGlobalId(), GetTargetFilePath(),
                    should_overwrite, callback));
   } else {
    Completed();
     BrowserThread::PostTask(
         BrowserThread::FILE, FROM_HERE,
         base::Bind(&DownloadFileManager::CompleteDownload,
                   file_manager, download_id_));
   }
 }

Vulnerability Type: DoS Overflow 
CWE ID: CWE-119
Summary: The PDF functionality in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger out-of-bounds write operations.
Commit Message: Refactors to simplify rename pathway in DownloadFileManager.

This is https://chromiumcodereview.appspot.com/10668004 / r144817 (reverted 
due to CrOS failure) with the completion logic moved to after the 
auto-opening.  The tests that test the auto-opening (for web store install) 
were waiting for download completion to check install, and hence were 
failing when completion was moved earlier.  

Doing this right would probably require another state (OPENED).  

BUG=123998
BUG-134930
R=asanka@chromium.org


Review URL: https://chromiumcodereview.appspot.com/10701040

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@145157 0039d316-1c4b-4281-b951-d872f2087c98