Cancel when InitProxyResolver cancels, so we don't use callback later.

net/proxy/dhcp_proxy_script_fetcher_win.cc

Index: net/proxy/dhcp_proxy_script_fetcher_win.cc
diff --git a/net/proxy/dhcp_proxy_script_fetcher_win.cc b/net/proxy/dhcp_proxy_script_fetcher_win.cc
index 94bf279b98f86b7951a73c902cb600caa0444271..dbe4df2b300f3e1a4a77500e7e0f0043e3d0877f 100644
--- a/net/proxy/dhcp_proxy_script_fetcher_win.cc
+++ b/net/proxy/dhcp_proxy_script_fetcher_win.cc
@@ -99,6 +99,7 @@ void DhcpProxyScriptFetcherWin::CancelImpl() {
   DCHECK(CalledOnValidThread());
 
   if (state_ != STATE_DONE) {
+    client_callback_ = NULL;
     wait_timer_.Stop();
     state_ = STATE_DONE;
 
@@ -206,9 +207,11 @@ void DhcpProxyScriptFetcherWin::TransitionToDone() {
     }
   }
 
+  CompletionCallback* callback = client_callback_;
   CancelImpl();
   DCHECK_EQ(state_, STATE_DONE);
   DCHECK(fetchers_.empty());
+  DCHECK(!client_callback_);  // Invariant of data.
 
   UMA_HISTOGRAM_TIMES("Net.DhcpWpadCompletionTime",
                       base::TimeTicks::Now() - fetch_start_time_);
@@ -218,7 +221,8 @@ void DhcpProxyScriptFetcherWin::TransitionToDone() {
         "Net.DhcpWpadFetchError", std::abs(result), GetAllErrorCodesForUma());
   }
 
-  client_callback_->Run(result);
+  // We may be deleted re-entrantly within this outcall.
+  callback->Run(result);
 }
 
 int DhcpProxyScriptFetcherWin::num_pending_fetchers() const {