Speculative fix for crash. Crashes seem to indicate

chrome/browser/extensions/extension_webnavigation_api.cc

Index: chrome/browser/extensions/extension_webnavigation_api.cc
diff --git a/chrome/browser/extensions/extension_webnavigation_api.cc b/chrome/browser/extensions/extension_webnavigation_api.cc
index 1736110a38e89df94646960413d950c6c0b12a88..865f92a8b032651fb30deda3c882a534f6048049 100644
--- a/chrome/browser/extensions/extension_webnavigation_api.cc
+++ b/chrome/browser/extensions/extension_webnavigation_api.cc
@@ -344,6 +344,9 @@ void ExtensionWebNavigationEventRouter::Init() {
     registrar_.Add(this,
                    content::NOTIFICATION_TAB_ADDED,
                    NotificationService::AllSources());
+    registrar_.Add(this,
+                   content::NOTIFICATION_TAB_CONTENTS_DESTROYED,
+                   NotificationService::AllSources());
   }
 }
 
@@ -360,6 +363,10 @@ void ExtensionWebNavigationEventRouter::Observe(
       TabAdded(Details<TabContents>(details).ptr());
       break;
 
+    case content::NOTIFICATION_TAB_CONTENTS_DESTROYED:
+      TabDestroyed(Source<TabContents>(source).ptr());
+      break;
+
     default:
       NOTREACHED();
   }
@@ -419,6 +426,20 @@ void ExtensionWebNavigationEventRouter::TabAdded(TabContents* tab_contents) {
   pending_tab_contents_.erase(iter);
 }
 
+void ExtensionWebNavigationEventRouter::TabDestroyed(
+    TabContents* tab_contents) {
+  pending_tab_contents_.erase(tab_contents);
+  for (std::map<TabContents*, PendingTabContents>::iterator i =
+           pending_tab_contents_.begin(); i != pending_tab_contents_.end(); ) {
+    if (i->second.source_tab_contents == tab_contents) {
+      std::map<TabContents*, PendingTabContents>::iterator to_erase = i;
+      ++i;
+      pending_tab_contents_.erase(to_erase);

[Matt Perry, 2011/08/03 19:00:21]

FYI, erase(i++) is equivalent

+    } else {
+      ++i;
+    }
+  }
+}
 
 // ExtensionWebNavigationTabObserver ------------------------------------------