Disable delegation to picker controller once it is deleted.

chrome/browser/ui/intents/web_intent_picker_controller.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/intents/web_intent_picker_controller.h"
 
 #include <vector>
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
@@ skipping 187 matching lines @@
                  content::Source<content::NavigationController>(controller));
   registrar_.Add(this, chrome::NOTIFICATION_TAB_CLOSING,
                  content::Source<content::NavigationController>(controller));
   native_services_.reset(new web_intents::NativeServiceFactory());
 #if defined(TOOLKIT_VIEWS)
   cancelled_ = true;
 #endif
 }
 
 WebIntentPickerController::~WebIntentPickerController() {
+  if (picker_)
+    picker_->InvalidateDelegate();
 }
 
 // TODO(gbillock): combine this with ShowDialog.
 void WebIntentPickerController::SetIntentsDispatcher(
     content::WebIntentsDispatcher* intents_dispatcher) {
   // TODO(gbillock): This is to account for multiple dispatches in the same tab.
   // That is currently not a well-handled case, and this is a band-aid.
   dispatcher_factory_.InvalidateWeakPtrs();
   intents_dispatcher_ = intents_dispatcher;
   intents_dispatcher_->RegisterReplyNotification(
@@ skipping 911 matching lines @@
   content::DownloadManager* download_manager =
       content::BrowserContext::GetDownloadManager(profile);
   if (!download_manager)
     return;
   content::DownloadItem* item =
       download_manager->GetDownload(download_id_.local());
   if (item)
     item->Cancel(true);
   download_id_ = content::DownloadId();
 }