Let CancelableRequest Execute callbacks which do delete this.

content/browser/cancelable_request.h

Index: content/browser/cancelable_request.h
diff --git a/content/browser/cancelable_request.h b/content/browser/cancelable_request.h
index 009ca98bf84e591ccabd65391f985eb0184860c2..769439f7a75816a1c7bfef3c441bf6798b76a309 100644
--- a/content/browser/cancelable_request.h
+++ b/content/browser/cancelable_request.h
@@ -659,11 +659,13 @@ class CancelableRequest : public CancelableRequestBase {
 
       // Execute the callback.
       callback_->RunWithParams(param);
+    }
 
-      // Notify the provider that the request is complete. The provider will
-      // notify the consumer for us.
+    // Notify the provider that the request is complete. The provider will
+    // notify the consumer for us. Note that it is possible for the callback to
+    // cancel this request; we must check canceled again.
+    if (!canceled_.IsSet())
       NotifyCompleted();
-    }
   }
 
   // This should only be executed if !canceled_.IsSet(),