web intents. Fix callbacks to restore tab management on service exit.

chrome/browser/ui/intents/web_intent_picker_controller.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_UI_INTENTS_WEB_INTENT_PICKER_CONTROLLER_H_
 #define CHROME_BROWSER_UI_INTENTS_WEB_INTENT_PICKER_CONTROLLER_H_
 
 #include <vector>
 
 #include "base/compiler_specific.h"
@@ skipping 289 matching lines @@
   // client page.
   content::WebIntentsDispatcher* intents_dispatcher_;
 
   // Weak pointer to the tab servicing the intent. Remembered in order to
   // close it when a reply is sent.
   content::WebContents* service_tab_;
 
   // Request consumer used when asynchronously loading favicons.
   CancelableRequestConsumerTSimple<size_t> favicon_consumer_;
 
+  // Factory for weak pointers used in callbacks for async calls to load the
+  // picker model.
   base::WeakPtrFactory<WebIntentPickerController> weak_ptr_factory_;
 
   // Timer factory for minimum display time of "waiting" dialog.
   base::WeakPtrFactory<WebIntentPickerController> timer_factory_;
 
+  // Weak pointers for the dispatcher OnSendReturnMessage will not be
+  // cancelled on picker close.
+  base::WeakPtrFactory<WebIntentPickerController> dispatcher_factory_;
+
   // Bucket identifier for UMA reporting. Saved off in a field
   // to avoid repeated calculation of the bucket across
   // multiple UMA calls. Should be recalculated each time
   // |intents_dispatcher_| is set.
   web_intents::UMABucket uma_bucket_;
 
   DISALLOW_COPY_AND_ASSIGN(WebIntentPickerController);
 };
 
 #endif  // CHROME_BROWSER_UI_INTENTS_WEB_INTENT_PICKER_CONTROLLER_H_