Fix destruction concurrency issue in PrerenderLocalPredictor:

chrome/browser/prerender/prerender_local_predictor.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_PRERENDER_PRERENDER_LOCAL_PREDICTOR_H_
 #define CHROME_BROWSER_PRERENDER_PRERENDER_LOCAL_PREDICTOR_H_
 #pragma once
 
 #include <vector>
 
@@ skipping 38 matching lines @@
 
   // Delay after which to initialize, to avoid putting to much load on the
   // database thread early on when Chrome is starting up.
   static const int kInitDelayMs = 5 * 1000;
 
   CancelableRequestConsumer history_db_consumer_;
 
   scoped_ptr<std::vector<history::BriefVisitInfo> > visit_history_;
   bool visit_history_initialized_;
 
+  // We keep a reference to the HistoryService which we registered to
+  // observe.  On destruction, we have to remove ourselves from that history
+  // service.  We can't just grab the HistoryService from the profile, because
+  // the profile may have already given up its reference to it.  Doing nothing
+  // in this case may cause crashes, because the HistoryService may outlive the
+  // the PrerenderLocalPredictor.
+  scoped_refptr<HistoryService> observing_history_service_;
+
   DISALLOW_COPY_AND_ASSIGN(PrerenderLocalPredictor);
 };
 
 }  // namespace prerender
 
 #endif  // CHROME_BROWSER_PRERENDER_PRERENDER_LOCAL_PREDICTOR_H_