Fix two race conditions in ImageDecoder.

chrome/browser/image_decoder.h

Index: chrome/browser/image_decoder.h
diff --git a/chrome/browser/image_decoder.h b/chrome/browser/image_decoder.h
index 438622c442d48a9b2bc5b125b11a8d299faccbd1..8bf7013c7dadad1848b95c72c541f305e37e3bbd 100644
--- a/chrome/browser/image_decoder.h
+++ b/chrome/browser/image_decoder.h
@@ -12,6 +12,7 @@
 #include "base/compiler_specific.h"
 #include "base/lazy_instance.h"
 #include "base/memory/ref_counted.h"
+#include "base/memory/weak_ptr.h"
 #include "base/synchronization/lock.h"
 #include "base/threading/sequenced_worker_pool.h"
 #include "base/timer/timer.h"
@@ -45,6 +46,8 @@ class ImageDecoder : public content::UtilityProcessHostClient {
       return task_runner_.get();
     }
 
+    base::WeakPtr<ImageRequest> GetWeakPtr();
+
    protected:
     explicit ImageRequest(
         const scoped_refptr<base::SequencedTaskRunner>& task_runner);
@@ -54,6 +57,8 @@ class ImageDecoder : public content::UtilityProcessHostClient {
     // The thread to post OnImageDecoded or OnDecodeImageFailed once the
     // the image has been decoded.
     const scoped_refptr<base::SequencedTaskRunner> task_runner_;
+
+    base::WeakPtrFactory<ImageRequest> weak_factory_;
   };
 
   enum ImageCodec {
@@ -87,14 +92,21 @@ class ImageDecoder : public content::UtilityProcessHostClient {
   // Sends a request to the sandboxed process to decode the image. Starts
   // batch mode if necessary. If the utility process fails to start,
   // an OnDecodeImageFailed task is posted to image_request's |task_runner_|.
-  void DecodeImageInSandbox(ImageRequest* image_request,
+  void DecodeImageInSandbox(int request_id,
                             const std::vector<unsigned char>& image_data,
                             ImageCodec image_codec,
                             bool shrink_to_fit);
 
+  void StartWithOptionsImpl(ImageRequest* image_request,
+                            const std::string& image_data,
+                            ImageCodec image_codec,
+                            bool shrink_to_fit);
   void CancelImpl(ImageRequest* image_request);
 
-  using RequestMap = std::map<int, ImageRequest*>;
+  using RequestMap =
+      std::map<int,
+               std::pair<scoped_refptr<base::SequencedTaskRunner>,
+                         base::WeakPtr<ImageRequest>>>;
 
   // Starts UtilityProcessHost in batch mode and starts |batch_mode_timer_|.
   // If the utility process fails to start, the method resets