Properly Remove Autofill Keyboard Listener.

content/browser/renderer_host/render_widget_host_impl.cc

Index: content/browser/renderer_host/render_widget_host_impl.cc
diff --git a/content/browser/renderer_host/render_widget_host_impl.cc b/content/browser/renderer_host/render_widget_host_impl.cc
index d6a5f498a82ac54bfc9bc3ce1de394d3bd40fe04..0a837864cf59243836aad28560d9e6d53bff1c49 100644
--- a/content/browser/renderer_host/render_widget_host_impl.cc
+++ b/content/browser/renderer_host/render_widget_host_impl.cc
@@ -1214,6 +1214,9 @@ void RenderWidgetHostImpl::AddKeyboardListener(KeyboardListener* listener) {
 
 void RenderWidgetHostImpl::RemoveKeyboardListener(
     KeyboardListener* listener) {
+  // Ensure that the element in actually in the list.

[Ilya Sherman, 2013/02/12 20:57:57]

nit: first "in" -> "is"

[csharp, 2013/02/12 21:02:37]

Done.

+  DCHECK(std::find(keyboard_listeners_.begin(), keyboard_listeners_.end(),
+                   listener) != keyboard_listeners_.end());

[Ilya Sherman, 2013/02/12 20:57:57]

I don't follow how this helps us spot this class of bug.  This would allow us to
detect double-removes, but that's not what's happening in this bug, right?

[csharp, 2013/02/12 21:02:37]

Yup, this bug here is that the Autofill controller was deleted before we got
here, so the pointer that is passed in is NULL (which doesn't appear in the list
so we assert).

[Ilya Sherman, 2013/02/12 21:07:43]

Ah, I thought we were passing in a pointer to memory that we no longer owned;
but if the pointer gets NULLed out, this makes sense.  Thanks.

   keyboard_listeners_.remove(listener);
 }