[net/predictor] Remove unsafe usage of WeakPtrFactory

The post task to delete the predictor on the IO thread comes from the
profile destruction. Thus, callers into the predictor on the UI thread
with *valid* profiles are guaranteed to have their IO thread tasks queued
before the predictor is torn down on the IO thread.

This means we can safely use base::Unretained in place of weak pointers
in these cases.

BUG=671970

Review-Url: https://codereview.chromium.org/2559323008
Cr-Commit-Position: refs/heads/master@{#437704}

chrome/browser/net/predictor.cc

@@ -312,9 +312,13 @@ std::vector<GURL> Predictor::GetPredictedUrlListAtStartup(
 
 void Predictor::DiscardAllResultsAndClearPrefsOnUIThread() {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  BrowserThread::PostTask(BrowserThread::IO, FROM_HERE,
-                          base::Bind(&Predictor::DiscardAllResults,
-                                     io_weak_factory_->GetWeakPtr()));
+  // The post task here is guaranteed to execute before the post task in
+  // ShutdownOnUIThread, because the caller has a valid profile here. Note that
+  // the ChromeNetBenchmarkingMessageFilter calls unsafely (an existing bug)
+  // into the profile, but doing so would crash before this point anyways.
+  BrowserThread::PostTask(
+      BrowserThread::IO, FROM_HERE,
+      base::Bind(&Predictor::DiscardAllResults, base::Unretained(this)));
   ClearPrefsOnUIThread();
 }
 
@@ -688,11 +692,12 @@ void Predictor::SaveStateForNextStartup() {
   base::ListValue* startup_list_raw = startup_list.get();
   base::ListValue* referral_list_raw = referral_list.get();
 
+  // The first post task here is guaranteed to execute before the post task in
+  // ShutdownOnUIThread, because the caller has a valid profile.
   BrowserThread::PostTaskAndReply(
       BrowserThread::IO, FROM_HERE,
-      base::Bind(&Predictor::WriteDnsPrefetchState,
-                 io_weak_factory_->GetWeakPtr(), startup_list_raw,
-                 referral_list_raw),
+      base::Bind(&Predictor::WriteDnsPrefetchState, base::Unretained(this),
+                 startup_list_raw, referral_list_raw),
       base::Bind(&Predictor::UpdatePrefsOnUIThread,
                  ui_weak_factory_->GetWeakPtr(),
                  base::Passed(std::move(startup_list)),