Fix potential crashes in NetworkHandler code

chrome/browser/io_thread.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/io_thread.h"
 
 #include <utility>
 #include <vector>
 
 #include "base/base64.h"
@@ skipping 538 matching lines @@
     value->GetAsBoolean(&is_quic_allowed_by_policy_);
 #endif  // ENABLE_CONFIGURATION_POLICY
 
   BrowserThread::SetDelegate(BrowserThread::IO, this);
 }
 
 IOThread::~IOThread() {
   // This isn't needed for production code, but in tests, IOThread may
   // be multiply constructed.
   BrowserThread::SetDelegate(BrowserThread::IO, NULL);
-
-  pref_proxy_config_tracker_->DetachFromPrefService();
+  ShutdownPrefProxyConfigTracker();
   DCHECK(!globals_);
 }
 
 IOThread::Globals* IOThread::globals() {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   return globals_;
 }
 
 void IOThread::SetGlobalsForTesting(Globals* globals) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
@@ skipping 315 matching lines @@
   // this task to the main thread's message loop here is guaranteed to
   // get it onto the message loop while the IOThread object still
   // exists.  However, the message might not be processed on the UI
   // thread until after IOThread is gone, so use a weak pointer.
   BrowserThread::PostTask(BrowserThread::UI,
                           FROM_HERE,
                           base::Bind(&IOThread::InitSystemRequestContext,
                                      weak_factory_.GetWeakPtr()));
 }
 
+void IOThread::ShutdownPrefProxyConfigTracker() {
+  if (!pref_proxy_config_tracker_)
+    return;
+  pref_proxy_config_tracker_->DetachFromPrefService();
+  pref_proxy_config_tracker_.reset();
+}
+
 void IOThread::CleanUp() {
   base::debug::LeakTracker<SafeBrowsingURLRequestContext>::CheckForLeaks();
 
 #if defined(USE_NSS_CERTS) || defined(OS_IOS)
   net::ShutdownNSSHttpIO();
 #endif
 
   system_url_request_context_getter_ = NULL;
 
   // Release objects that the net::URLRequestContext could have been pointing
@@ skipping 842 matching lines @@
       std::move(job_factory);
 
   context->set_job_factory(
       globals->proxy_script_fetcher_url_request_job_factory.get());
 
   // TODO(rtenneti): We should probably use HttpServerPropertiesManager for the
   // system URLRequestContext too. There's no reason this should be tied to a
   // profile.
   return context;
 }