Explicitly free the web contents in the background contents destructor.

chrome/browser/tab_contents/background_contents.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/tab_contents/background_contents.h"
 
 #include "chrome/browser/background/background_contents_service.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/renderer_preferences_util.h"
 #include "chrome/browser/ui/webui/chrome_web_ui_controller_factory.h"
@@ skipping 43 matching lines @@
       profile_(NULL) {
 }
 
 BackgroundContents::~BackgroundContents() {
   if (!web_contents_.get())   // Will be null for unit tests.
     return;
   content::NotificationService::current()->Notify(
       chrome::NOTIFICATION_BACKGROUND_CONTENTS_DELETED,
       content::Source<Profile>(profile_),
       content::Details<BackgroundContents>(this));
+  // Manually clear web_contents_ to try to track down http://crbug.com/164617.
+  // Freeing the WebContents can cause the RenderViewHost to be destroyed, so
+  // we need to do this after sending out BACKGROUND_CONTENTS_DELETED to give
+  // things like the TaskManager a chance to clean up their references first.
+  web_contents_.reset();
 }
 
 const GURL& BackgroundContents::GetURL() const {
   return web_contents_.get() ? web_contents_->GetURL() : GURL::EmptyGURL();
 }
 
 void BackgroundContents::CloseContents(WebContents* source) {
   content::NotificationService::current()->Notify(
       chrome::NOTIFICATION_BACKGROUND_CONTENTS_CLOSED,
       content::Source<Profile>(profile_),
@@ skipping 52 matching lines @@
     case chrome::NOTIFICATION_PROFILE_DESTROYED:
     case chrome::NOTIFICATION_APP_TERMINATING: {
       delete this;
       break;
     }
     default:
       NOTREACHED() << "Unexpected notification sent.";
       break;
   }
 }