Fix use-after-free in WebstoreInstaller

chrome/browser/extensions/webstore_installer.h

Index: chrome/browser/extensions/webstore_installer.h
diff --git a/chrome/browser/extensions/webstore_installer.h b/chrome/browser/extensions/webstore_installer.h
index 7e48bb82d04497b9f0c9e5fc0c2550d7375f2c46..a8b6ce43edbe9cca24fc20e5ccc6c15e65694580 100644
--- a/chrome/browser/extensions/webstore_installer.h
+++ b/chrome/browser/extensions/webstore_installer.h
@@ -20,6 +20,7 @@
 #include "content/public/browser/download_item.h"
 #include "content/public/browser/notification_observer.h"
 #include "content/public/browser/notification_registrar.h"
+#include "content/public/browser/web_contents_observer.h"
 #include "extensions/common/manifest_handlers/shared_module_info.h"
 #include "ui/gfx/image/image_skia.h"
 #include "url/gurl.h"
@@ -31,7 +32,7 @@ class FilePath;
 }
 
 namespace content {
-class NavigationController;
+class WebContents;
 }
 
 namespace extensions {
@@ -40,9 +41,10 @@ class Extension;
 class Manifest;
 
 // Downloads and installs extensions from the web store.
-class WebstoreInstaller :public content::NotificationObserver,
-                         public content::DownloadItem::Observer,
-                         public base::RefCountedThreadSafe<
+class WebstoreInstaller : public content::NotificationObserver,
+                          public content::DownloadItem::Observer,
+                          public content::WebContentsObserver,
+                          public base::RefCountedThreadSafe<
   WebstoreInstaller, content::BrowserThread::DeleteOnUIThread> {
  public:
   enum InstallSource {
@@ -172,7 +174,7 @@ class WebstoreInstaller :public content::NotificationObserver,
   // Note: the delegate should stay alive until being called back.
   WebstoreInstaller(Profile* profile,
                     Delegate* delegate,
-                    content::NavigationController* controller,
+                    content::WebContents* web_contents,
                     const std::string& id,
                     scoped_ptr<Approval> approval,
                     InstallSource source);
@@ -237,7 +239,6 @@ class WebstoreInstaller :public content::NotificationObserver,
   content::NotificationRegistrar registrar_;
   Profile* profile_;
   Delegate* delegate_;
-  content::NavigationController* controller_;
   std::string id_;
   InstallSource install_source_;
   // The DownloadItem is owned by the DownloadManager and is valid from when