[Panels] Fix favicon crash from using deleted WebContents.

chrome/browser/ui/panels/panel_host.cc

Index: chrome/browser/ui/panels/panel_host.cc
diff --git a/chrome/browser/ui/panels/panel_host.cc b/chrome/browser/ui/panels/panel_host.cc
index a8d7704cc5f8973e5e8e1caa10c491bc7d9ea220..1dcef9c1552b898975c2d17ab8c223f8976e5d2b 100644
--- a/chrome/browser/ui/panels/panel_host.cc
+++ b/chrome/browser/ui/panels/panel_host.cc
@@ -71,7 +71,12 @@ void PanelHost::Init(const GURL& url) {
 }
 
 void PanelHost::DestroyWebContents() {
-  web_contents_.reset();
+  // Cannot do a web_contents_.reset() because web_contents_.get() will
+  // still return the pointer when we CHECK in WebContentsDestroyed (or if
+  // we get called back in the middle of web contents destruction, which
+  // WebView might do when it detects the web contents is destroyed).
+  content::WebContents* contents = web_contents_.release();
+  delete contents;
 }
 
 gfx::Image PanelHost::GetPageIcon() const {
@@ -80,6 +85,7 @@ gfx::Image PanelHost::GetPageIcon() const {
 
   FaviconTabHelper* favicon_tab_helper =
       FaviconTabHelper::FromWebContents(web_contents_.get());
+  CHECK(favicon_tab_helper);
   return favicon_tab_helper->GetFavicon();
 }
 
@@ -203,6 +209,9 @@ void PanelHost::RenderViewGone(base::TerminationStatus status) {
 }
 
 void PanelHost::WebContentsDestroyed(content::WebContents* web_contents) {
+  // Web contents should only be destroyed by us.
+  CHECK(!web_contents_.get());
+
   // Close the panel after we return to the message loop (not immediately,
   // otherwise, it may destroy this object before the stack has a chance
   // to cleanly unwind.)