Fix destruction concurrency issue in PrerenderLocalPredictor:

chrome/browser/prerender/prerender_local_predictor.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_PRERENDER_PRERENDER_LOCAL_PREDICTOR_H_
 #define CHROME_BROWSER_PRERENDER_PRERENDER_LOCAL_PREDICTOR_H_
 #pragma once
 
 #include <vector>
 
@@ skipping 38 matching lines @@
 
   // Delay after which to initialize, to avoid putting to much load on the
   // database thread early on when Chrome is starting up.
   static const int kInitDelayMs = 5 * 1000;
 
   CancelableRequestConsumer history_db_consumer_;
 
   scoped_ptr<std::vector<history::BriefVisitInfo> > visit_history_;
   bool visit_history_initialized_;
 
+  // We keep a reference to the HistoryService which we registered to
+  // observe.  On destruction, we have to remove ourselves from that history
+  // service.

[brettw, 2012/04/24 18:17:15]

I think it would be worth mentioning here why you can't just grab it from the
profile. I could imagine doing refactoring and "fixing" this case by removing
your cached value.

[tburkard, 2012/04/24 18:39:57]

Done.

+  scoped_refptr<HistoryService> observing_history_service_;
+
   DISALLOW_COPY_AND_ASSIGN(PrerenderLocalPredictor);
 };
 
 }  // namespace prerender
 
 #endif  // CHROME_BROWSER_PRERENDER_PRERENDER_LOCAL_PREDICTOR_H_