Fix a used-after-free caused by an unremoved Observer.

chrome/browser/ui/webui/settings/profile_info_handler.cc

Index: chrome/browser/ui/webui/settings/profile_info_handler.cc
diff --git a/chrome/browser/ui/webui/settings/profile_info_handler.cc b/chrome/browser/ui/webui/settings/profile_info_handler.cc
index 6116ba9b8aedec4a31da8dd053f9bbe8523dda62..c3b0de8a66be9a35e9db36343d7b9fe818ce9030 100644
--- a/chrome/browser/ui/webui/settings/profile_info_handler.cc
+++ b/chrome/browser/ui/webui/settings/profile_info_handler.cc
@@ -31,7 +31,11 @@ namespace settings {
 const char ProfileInfoHandler::kProfileInfoChangedEventName[] =
     "profile-info-changed";
 
-ProfileInfoHandler::ProfileInfoHandler(Profile* profile) : profile_(profile) {}
+ProfileInfoHandler::ProfileInfoHandler(Profile* profile)
+    : profile_(profile),
+      profile_observer_(this) {}
+
+ProfileInfoHandler::~ProfileInfoHandler() {}
 
 void ProfileInfoHandler::RegisterMessages() {
   web_ui()->RegisterMessageCallback(
@@ -40,9 +44,8 @@ void ProfileInfoHandler::RegisterMessages() {
 }
 
 void ProfileInfoHandler::OnJavascriptAllowed() {
-  g_browser_process->profile_manager()
-      ->GetProfileAttributesStorage()
-      .AddObserver(this);
+  profile_observer_.Add(
+      &g_browser_process->profile_manager()->GetProfileAttributesStorage());
 
 #if defined(OS_CHROMEOS)
   registrar_.Add(this, chrome::NOTIFICATION_LOGIN_USER_IMAGE_CHANGED,
@@ -51,9 +54,8 @@ void ProfileInfoHandler::OnJavascriptAllowed() {
 }
 
 void ProfileInfoHandler::OnJavascriptDisallowed() {
-  g_browser_process->profile_manager()
-      ->GetProfileAttributesStorage()
-      .RemoveObserver(this);
+  profile_observer_.Remove(
+      &g_browser_process->profile_manager()->GetProfileAttributesStorage());
 
 #if defined(OS_CHROMEOS)
   registrar_.RemoveAll();