Let CancelableRequest Execute callbacks which do delete this.

content/browser/cancelable_request.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // CancelableRequestProviders and Consumers work together to make requests that
 // execute on a background thread in the provider and return data to the
 // consumer. These class collaborate to keep a list of open requests and to
 // make sure that requests to not outlive either of the objects involved in the
 // transaction.
 //
@@ skipping 641 matching lines @@
 
  private:
   // Executes the callback and notifies the provider and the consumer that this
   // request has been completed. This must be called on the callback_thread_.
   void ExecuteCallback(const TupleType& param) {
     if (!canceled_.IsSet()) {
       WillExecute();
 
       // Execute the callback.
       callback_->RunWithParams(param);
+    }
 
-      // Notify the provider that the request is complete. The provider will
-      // notify the consumer for us.
+    // Notify the provider that the request is complete. The provider will
+    // notify the consumer for us. Note that it is possible for the callback to
+    // cancel this request; we must check canceled again.
+    if (!canceled_.IsSet())
       NotifyCompleted();
-    }
   }
 
   // This should only be executed if !canceled_.IsSet(),
   // otherwise the pointers may be invalid.
   scoped_ptr<CallbackType> callback_;
 };
 
 // A CancelableRequest with a single value. This is intended for use when
 // the provider provides a single value. The provider fills the result into
 // the value, and notifies the request with a pointer to the value. For example,
@@ skipping 18 matching lines @@
   }
 
   // The value.
   Type value;
 
  protected:
   virtual ~CancelableRequest1() {}
 };
 
 #endif  // CONTENT_BROWSER_CANCELABLE_REQUEST_H_