Cancel when InitProxyResolver cancels, so we don't use callback later.

net/proxy/dhcp_proxy_script_fetcher_win.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/proxy/dhcp_proxy_script_fetcher_win.h"
 
 #include "base/metrics/histogram.h"
 #include "base/perftimer.h"
 #include "net/base/net_errors.h"
 #include "net/proxy/dhcp_proxy_script_adapter_fetcher_win.h"
@@ skipping 81 matching lines @@
                         base::TimeTicks::Now() - fetch_start_time_);
   }
 
   CancelImpl();
 }
 
 void DhcpProxyScriptFetcherWin::CancelImpl() {
   DCHECK(CalledOnValidThread());
 
   if (state_ != STATE_DONE) {
+    client_callback_ = NULL;
     wait_timer_.Stop();
     state_ = STATE_DONE;
 
     for (FetcherVector::iterator it = fetchers_.begin();
          it != fetchers_.end();
          ++it) {
       (*it)->Cancel();
     }
 
     fetchers_.reset();
@@ skipping 87 matching lines @@
          ++it) {
       if ((*it)->DidFinish()) {
         result = (*it)->GetResult();
         if (result != ERR_PAC_NOT_IN_DHCP) {
           break;
         }
       }
     }
   }
 
+  CompletionCallback* callback = client_callback_;
   CancelImpl();
   DCHECK_EQ(state_, STATE_DONE);
   DCHECK(fetchers_.empty());
+  DCHECK(!client_callback_);  // Invariant of data.
 
   UMA_HISTOGRAM_TIMES("Net.DhcpWpadCompletionTime",
                       base::TimeTicks::Now() - fetch_start_time_);
 
   if (result != OK) {
     UMA_HISTOGRAM_CUSTOM_ENUMERATION(
         "Net.DhcpWpadFetchError", std::abs(result), GetAllErrorCodesForUma());
   }
 
-  client_callback_->Run(result);
+  // We may be deleted re-entrantly within this outcall.
+  callback->Run(result);
 }
 
 int DhcpProxyScriptFetcherWin::num_pending_fetchers() const {
   return num_pending_fetchers_;
 }
 
 URLRequestContext* DhcpProxyScriptFetcherWin::url_request_context() const {
   return url_request_context_;
 }
 
@@ skipping 71 matching lines @@
       continue;
 
     DCHECK(adapter->AdapterName);
     adapter_names->insert(adapter->AdapterName);
   }
 
   return true;
 }
 
 }  // namespace net