web intents. Fix callbacks to restore tab management on service exit.

chrome/browser/ui/intents/web_intent_picker_controller.h

Index: chrome/browser/ui/intents/web_intent_picker_controller.h
diff --git a/chrome/browser/ui/intents/web_intent_picker_controller.h b/chrome/browser/ui/intents/web_intent_picker_controller.h
index 27a75a2533600f806fe8e7aff873f122a9512694..78d3c37b2cc718a3599e641c654715049b24985b 100644
--- a/chrome/browser/ui/intents/web_intent_picker_controller.h
+++ b/chrome/browser/ui/intents/web_intent_picker_controller.h
@@ -307,11 +307,17 @@ class WebIntentPickerController
   // Request consumer used when asynchronously loading favicons.
   CancelableRequestConsumerTSimple<size_t> favicon_consumer_;
 
+  // Factory for weak pointers used in callbacks for async calls to load the
+  // picker model.
   base::WeakPtrFactory<WebIntentPickerController> weak_ptr_factory_;
 
   // Timer factory for minimum display time of "waiting" dialog.
   base::WeakPtrFactory<WebIntentPickerController> timer_factory_;
 
+  // Weak pointers for the dispatcher OnSendReturnMessage will not be
+  // cancelled on picker close.
+  base::WeakPtrFactory<WebIntentPickerController> dispatcher_factory_;
+
   // Bucket identifier for UMA reporting. Saved off in a field
   // to avoid repeated calculation of the bucket across
   // multiple UMA calls. Should be recalculated each time