Fix destruction concurrency issue in PrerenderLocalPredictor:

chrome/browser/prerender/prerender_local_predictor.h

Index: chrome/browser/prerender/prerender_local_predictor.h
===================================================================
--- chrome/browser/prerender/prerender_local_predictor.h	(revision 133717)
+++ chrome/browser/prerender/prerender_local_predictor.h	(working copy)
@@ -56,6 +56,11 @@
   scoped_ptr<std::vector<history::BriefVisitInfo> > visit_history_;
   bool visit_history_initialized_;
 
+  // We keep a reference to the HistoryService which we registered to
+  // observe.  On destruction, we have to remove ourselves from that history
+  // service.

[brettw, 2012/04/24 18:17:15]

I think it would be worth mentioning here why you can't just grab it from the
profile. I could imagine doing refactoring and "fixing" this case by removing
your cached value.

[tburkard, 2012/04/24 18:39:57]

Done.

+  scoped_refptr<HistoryService> observing_history_service_;
+
   DISALLOW_COPY_AND_ASSIGN(PrerenderLocalPredictor);
 };