Fix destruction concurrency issue in PrerenderLocalPredictor:

PrerenderLocalPredictor will now keep around a reference to the HistoryService
that it subscribed too, and will unsubscribe itself on destruction.
Since PrerenderLocalPredictor is owned by PrerenderManager, and both
PrerenderManager and HistoryService have the same lifetime as the underlying
profile, the HistoryService object will not be kept around unnecessarily
longer as a result of this.
R=brettw, cbentzel
Review URL: https://chromiumcodereview.appspot.com/10214004

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@133744 0039d316-1c4b-4281-b951-d872f2087c98

chrome/browser/prerender/prerender_local_predictor.cc

@@ -88,9 +88,8 @@ PrerenderLocalPredictor::PrerenderLocalPredictor(
 }
 
 PrerenderLocalPredictor::~PrerenderLocalPredictor() {
-  HistoryService* history = GetHistoryIfExists();
-  if (history)
-    history->RemoveVisitDatabaseObserver(this);
+  if (observing_history_service_.get())
+    observing_history_service_->RemoveVisitDatabaseObserver(this);
 }
 
 void PrerenderLocalPredictor::OnAddVisit(const history::BriefVisitInfo& info) {
@@ -133,7 +132,8 @@ void PrerenderLocalPredictor::Init() {
   history->ScheduleDBTask(
       new GetVisitHistoryTask(this, kMaxVisitHistory),
       &history_db_consumer_);
-  history->AddVisitDatabaseObserver(this);
+  observing_history_service_ = history;
+  observing_history_service_->AddVisitDatabaseObserver(this);
 }
 
 }  // namespace prerender

chrome/browser/prerender/prerender_local_predictor.h

@@ -56,6 +56,14 @@ class PrerenderLocalPredictor : history::VisitDatabaseObserver {
   scoped_ptr<std::vector<history::BriefVisitInfo> > visit_history_;
   bool visit_history_initialized_;
 
+  // We keep a reference to the HistoryService which we registered to
+  // observe.  On destruction, we have to remove ourselves from that history
+  // service.  We can't just grab the HistoryService from the profile, because
+  // the profile may have already given up its reference to it.  Doing nothing
+  // in this case may cause crashes, because the HistoryService may outlive the
+  // the PrerenderLocalPredictor.
+  scoped_refptr<HistoryService> observing_history_service_;
+
   DISALLOW_COPY_AND_ASSIGN(PrerenderLocalPredictor);
 };