Fix a used-after-free caused by an unremoved Observer.

chrome/browser/ui/webui/settings/profile_info_handler.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/webui/settings/profile_info_handler.h"
 
 #include "base/bind.h"
 #include "base/memory/ptr_util.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/profiles/profile.h"
@@ skipping 13 matching lines @@
 #include "chrome/browser/profiles/profile_avatar_icon_util.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 #endif
 
 namespace settings {
 
 // static
 const char ProfileInfoHandler::kProfileInfoChangedEventName[] =
     "profile-info-changed";
 
-ProfileInfoHandler::ProfileInfoHandler(Profile* profile) : profile_(profile) {}
+ProfileInfoHandler::ProfileInfoHandler(Profile* profile)
+    : profile_(profile),
+      profile_observer_(this) {}
+
+ProfileInfoHandler::~ProfileInfoHandler() {}
 
 void ProfileInfoHandler::RegisterMessages() {
   web_ui()->RegisterMessageCallback(
       "getProfileInfo", base::Bind(&ProfileInfoHandler::HandleGetProfileInfo,
                                    base::Unretained(this)));
 }
 
 void ProfileInfoHandler::OnJavascriptAllowed() {
-  g_browser_process->profile_manager()
-      ->GetProfileAttributesStorage()
-      .AddObserver(this);
+  profile_observer_.Add(
+      &g_browser_process->profile_manager()->GetProfileAttributesStorage());
 
 #if defined(OS_CHROMEOS)
   registrar_.Add(this, chrome::NOTIFICATION_LOGIN_USER_IMAGE_CHANGED,
                  content::NotificationService::AllSources());
 #endif
 }
 
 void ProfileInfoHandler::OnJavascriptDisallowed() {
-  g_browser_process->profile_manager()
-      ->GetProfileAttributesStorage()
-      .RemoveObserver(this);
+  profile_observer_.Remove(
+      &g_browser_process->profile_manager()->GetProfileAttributesStorage());
 
 #if defined(OS_CHROMEOS)
   registrar_.RemoveAll();
 #endif
 }
 
 #if defined(OS_CHROMEOS)
 void ProfileInfoHandler::Observe(int type,
                                  const content::NotificationSource& source,
                                  const content::NotificationDetails& details) {
@@ skipping 74 matching lines @@
   }
 #endif  // defined(OS_CHROMEOS)
 
   base::DictionaryValue* response = new base::DictionaryValue();
   response->SetString("name", name);
   response->SetString("iconUrl", icon_url);
   return base::WrapUnique(response);
 }
 
 }  // namespace settings