Modify ProfileDestroyer to prevent leaks.

chrome/browser/profiles/profile_destroyer.h

Index: chrome/browser/profiles/profile_destroyer.h
===================================================================
--- chrome/browser/profiles/profile_destroyer.h	(revision 143384)
+++ chrome/browser/profiles/profile_destroyer.h	(working copy)
@@ -9,6 +9,7 @@
 #include <vector>
 
 #include "base/memory/ref_counted.h"
+#include "base/timer.h"
 #include "content/public/browser/notification_observer.h"
 #include "content/public/browser/notification_registrar.h"
 
@@ -24,6 +25,7 @@
       public base::RefCounted<ProfileDestroyer> {
  public:
   static void DestroyProfileWhenAppropriate(Profile* const profile);
+  static void DestroyOffTheRecordProfileNow(Profile* const profile);
 
  private:
   friend class base::RefCounted<ProfileDestroyer>;
@@ -37,6 +39,8 @@
   virtual void Observe(int type,
                        const content::NotificationSource& source,
                        const content::NotificationDetails& details) OVERRIDE;
+  // Called by the timer to cancel the pending detruction and do it now.
+  void DestroyProfile();
 
   // Fetch the list of render process hosts that still refer to the profile.
   // Return true if we found at least one, false otherwise.
@@ -44,9 +48,20 @@
       Profile* const profile,
       std::vector<content::RenderProcessHost*> *hosts);
 
+  // We need access to all pending destroyers so we can cancel them.
+  static std::vector<ProfileDestroyer*>* pending_destroyers_;
+
+  // We register for render process host termination.
   content::NotificationRegistrar registrar_;
-  Profile* const profile_;
 
+  // We don't want to wait forever, so we have a cancellation timer.
+  base::Timer timer_;
+
+  // Used to count down the number of render process host left.
+  uint32 num_hosts_;
+
+  Profile* profile_;
+
   DISALLOW_COPY_AND_ASSIGN(ProfileDestroyer);
 };