Timur's suggested fix for the data race described in bug 18488...

chrome/browser/history/history_marshaling.h

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Data structures for communication between the history service on the main
 // thread and the backend on the history thread.
 
 #ifndef CHROME_BROWSER_HISTORY_HISTORY_MARSHALING_H__
 #define CHROME_BROWSER_HISTORY_HISTORY_MARSHALING_H__
 
 #include "base/scoped_vector.h"
 #include "chrome/browser/cancelable_request.h"
 #include "chrome/browser/history/history.h"
 #include "chrome/browser/history/page_usage_data.h"
 
 namespace history {
 
 // Navigation -----------------------------------------------------------------
 
 // Marshalling structure for AddPage.
-class HistoryAddPageArgs : public base::RefCounted<HistoryAddPageArgs> {
+class HistoryAddPageArgs : public base::RefCountedThreadSafe<HistoryAddPageArgs> {
  public:
   HistoryAddPageArgs(const GURL& arg_url,
                      base::Time arg_time,
                      const void* arg_id_scope,
                      int32 arg_page_id,
                      const GURL& arg_referrer,
                      const history::RedirectList& arg_redirects,
                      PageTransition::Type arg_transition,
                      bool arg_did_replace_entry)
       : url(arg_url),
@@ skipping 89 matching lines @@
 // The argument here is an input value, which is the task to run on the
 // background thread. The callback is used to execute the portion of the task
 // that executes on the main thread.
 typedef CancelableRequest1<HistoryService::HistoryDBTaskCallback,
                            scoped_refptr<HistoryDBTask> >
     HistoryDBTaskRequest;
 
 }  // namespace history
 
 #endif  // CHROME_BROWSER_HISTORY_HISTORY_MARSHALING_H__