Attempt at fixing crash in tab code. It appears that we end up in a

chrome/browser/tabs/tab_strip_model.cc

Index: chrome/browser/tabs/tab_strip_model.cc
diff --git a/chrome/browser/tabs/tab_strip_model.cc b/chrome/browser/tabs/tab_strip_model.cc
index 5e877c13a615337574ff3894aaf5c99135c829d1..d6e5bc1d7810f1acbe183eaa6b84033d46477b9f 100644
--- a/chrome/browser/tabs/tab_strip_model.cc
+++ b/chrome/browser/tabs/tab_strip_model.cc
@@ -141,6 +141,8 @@ void TabStripModel::InsertTabContentsAt(int index,
     }
     // Anything opened by a link we deem to have an opener.
     data->SetGroup(&selected_contents->controller());
+    // TODO(sky): nuke when we figure out what is causing 34135.
+    CHECK(data->opener != &(contents->controller()));
   } else if ((add_types & ADD_INHERIT_OPENER) && selected_contents) {
     if (foreground) {
       // Forget any existing relationships, we don't want to make things too
@@ -148,6 +150,8 @@ void TabStripModel::InsertTabContentsAt(int index,
       ForgetAllOpeners();
     }
     data->opener = &selected_contents->controller();
+    // TODO(sky): nuke when we figure out what is causing 34135.
+    CHECK(data->opener != &(contents->controller()));
   }
 
   contents_data_.insert(contents_data_.begin() + index, data);
@@ -168,11 +172,11 @@ void TabStripModel::InsertTabContentsAt(int index,
 TabContentsWrapper* TabStripModel::ReplaceTabContentsAt(
     int index,
     TabContentsWrapper* new_contents) {
-  // TODO: this should reset group/opener of any tabs that point at
-  // old_contents.
   DCHECK(ContainsIndex(index));
   TabContentsWrapper* old_contents = GetContentsAt(index);
 
+  ForgetOpenersAndGroupsReferencing(&(old_contents->controller()));
+
   contents_data_[index]->contents = new_contents;
 
   FOR_EACH_OBSERVER(TabStripModelObserver, observers_,
@@ -217,6 +221,7 @@ TabContentsWrapper* TabStripModel::DetachTabContentsAt(int index) {
   volatile TabContentsData old_data = *contents_data_.at(index);
   delete contents_data_.at(index);
   contents_data_.erase(contents_data_.begin() + index);
+  ForgetOpenersAndGroupsReferencing(&(removed_contents->controller()));
   if (empty())
     closing_all_ = true;
   FOR_EACH_OBSERVER(TabStripModelObserver, observers_,
@@ -1016,3 +1021,14 @@ bool TabStripModel::OpenerMatches(const TabContentsData* data,
                                   bool use_group) {
   return data->opener == opener || (use_group && data->group == opener);
 }
+
+void TabStripModel::ForgetOpenersAndGroupsReferencing(
+    const NavigationController* tab) {
+  for (TabContentsDataVector::const_iterator i = contents_data_.begin();
+       i != contents_data_.end(); ++i) {
+    if ((*i)->group == tab)
+      (*i)->group = NULL;
+    if ((*i)->opener == tab)
+      (*i)->opener = NULL;
+  }
+}