Speculative fix for crash. Crashes seem to indicate

chrome/browser/extensions/extension_webnavigation_api.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Implements the Chrome Extensions WebNavigation API.
 
 #include "chrome/browser/extensions/extension_webnavigation_api.h"
 
 #include "base/json/json_writer.h"
 #include "base/lazy_instance.h"
@@ skipping 326 matching lines @@
 ExtensionWebNavigationEventRouter::~ExtensionWebNavigationEventRouter() {}
 
 void ExtensionWebNavigationEventRouter::Init() {
   if (registrar_.IsEmpty()) {
     registrar_.Add(this,
                    content::NOTIFICATION_RETARGETING,
                    Source<Profile>(profile_));
     registrar_.Add(this,
                    content::NOTIFICATION_TAB_ADDED,
                    NotificationService::AllSources());
+    registrar_.Add(this,
+                   content::NOTIFICATION_TAB_CONTENTS_DESTROYED,
+                   NotificationService::AllSources());
   }
 }
 
 void ExtensionWebNavigationEventRouter::Observe(
     int type,
     const NotificationSource& source,
     const NotificationDetails& details) {
   switch (type) {
     case content::NOTIFICATION_RETARGETING:
       Retargeting(Details<const content::RetargetingDetails>(details).ptr());
       break;
 
     case content::NOTIFICATION_TAB_ADDED:
       TabAdded(Details<TabContents>(details).ptr());
       break;
 
+    case content::NOTIFICATION_TAB_CONTENTS_DESTROYED:
+      TabDestroyed(Source<TabContents>(source).ptr());
+      break;
+
     default:
       NOTREACHED();
   }
 }
 
 void ExtensionWebNavigationEventRouter::Retargeting(
     const content::RetargetingDetails* details) {
   if (details->source_frame_id == 0)
     return;
   ExtensionWebNavigationTabObserver* tab_observer =
@@ skipping 39 matching lines @@
 
   DispatchOnBeforeRetarget(iter->second.source_tab_contents,
                            iter->second.target_tab_contents->browser_context(),
                            iter->second.source_frame_id,
                            iter->second.source_frame_is_main_frame,
                            iter->second.target_tab_contents,
                            iter->second.target_url);
   pending_tab_contents_.erase(iter);
 }
 
+void ExtensionWebNavigationEventRouter::TabDestroyed(
+    TabContents* tab_contents) {
+  pending_tab_contents_.erase(tab_contents);
+  for (std::map<TabContents*, PendingTabContents>::iterator i =
+           pending_tab_contents_.begin(); i != pending_tab_contents_.end(); ) {
+    if (i->second.source_tab_contents == tab_contents) {
+      std::map<TabContents*, PendingTabContents>::iterator to_erase = i;
+      ++i;
+      pending_tab_contents_.erase(to_erase);

[Matt Perry, 2011/08/03 19:00:21]

FYI, erase(i++) is equivalent

+    } else {
+      ++i;
+    }
+  }
+}
 
 // ExtensionWebNavigationTabObserver ------------------------------------------
 
 ExtensionWebNavigationTabObserver::ExtensionWebNavigationTabObserver(
     TabContents* tab_contents)
     : TabContentsObserver(tab_contents) {
   g_tab_observer.Get().insert(TabObserverMap::value_type(tab_contents, this));
 }
 
 ExtensionWebNavigationTabObserver::~ExtensionWebNavigationTabObserver() {}
@@ skipping 174 matching lines @@
   DictionaryValue* resultDict = new DictionaryValue();
   resultDict->SetString(
       keys::kUrlKey,
       frame_navigation_state.GetUrl(frame_id).spec());
   resultDict->SetBoolean(
       keys::kErrorOccurredKey,
       frame_navigation_state.GetErrorOccurredInFrame(frame_id));
   result_.reset(resultDict);
   return true;
 }