Profile shouldn't own DesktopNotificationService.

chrome/browser/profiles/profile_keyed_service_factory.cc

Index: chrome/browser/profiles/profile_keyed_service_factory.cc
diff --git a/chrome/browser/profiles/profile_keyed_service_factory.cc b/chrome/browser/profiles/profile_keyed_service_factory.cc
index cea66c933c15bcf94451f9538da6907f1cc9ffa6..755409e28257057567530e22b8f071cb5bfc67eb 100644
--- a/chrome/browser/profiles/profile_keyed_service_factory.cc
+++ b/chrome/browser/profiles/profile_keyed_service_factory.cc
@@ -13,7 +13,7 @@
 
 ProfileKeyedServiceFactory::ProfileKeyedServiceFactory(
     ProfileDependencyManager* manager)
-    : dependency_manager_(manager) {
+    : dependency_manager_(manager), factory_(NULL) {
   dependency_manager_->AddComponent(this);
 }
 
@@ -35,12 +35,22 @@ ProfileKeyedService* ProfileKeyedServiceFactory::GetServiceForProfile(
     }
   }
 
+  ProfileKeyedService* service;
+
   std::map<Profile*, ProfileKeyedService*>::iterator it =
       mapping_.find(profile);
-  if (it != mapping_.end())
-    return it->second;
+  if (it != mapping_.end()) {
+    service = it->second;
+    if (service || !factory_)
+      return service;
+
+    // service is NULL but we have a mock factory function
+    mapping_.erase(it);
+    service = factory_(profile);
+  } else {
+    service = BuildServiceInstanceFor(profile);
+  }
 
-  ProfileKeyedService* service = BuildServiceInstanceFor(profile);
   Associate(profile, service);
   return service;
 }
@@ -66,7 +76,7 @@ bool ProfileKeyedServiceFactory::ServiceHasOwnInstanceInIncognito() {
 void ProfileKeyedServiceFactory::ProfileShutdown(Profile* profile) {
   std::map<Profile*, ProfileKeyedService*>::iterator it =
       mapping_.find(profile);
-  if (it != mapping_.end())
+  if (it != mapping_.end() && it->second)
     it->second->Shutdown();
 }