CRASH at Tab::OnMouseReleased...

chrome/browser/views/tabs/tab.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/views/tabs/tab.h"
 
 #include "base/gfx/size.h"
 #include "chrome/common/gfx/chrome_canvas.h"
 #include "chrome/common/gfx/path.h"
 #include "chrome/common/l10n_util.h"
@@ skipping 160 matching lines @@
 }
 
 bool Tab::OnMouseDragged(const views::MouseEvent& event) {
   delegate_->ContinueDrag(event);
   return true;
 }
 
 void Tab::OnMouseReleased(const views::MouseEvent& event, bool canceled) {
   // Notify the drag helper that we're done with any potential drag operations.
   // Clean up the drag helper, which is re-created on the next mouse press.
-  delegate_->EndDrag(canceled);
+  // In some cases, ending the drag will schedule the tab for destruction; if
+  // so, bail immediately, since our members are already dead and we shouldn't
+  // do anything else except drop the tab where it is.
+  if (delegate_->EndDrag(canceled))
+    return;
 
-  // Close tabs on middle click, but only if the button is released over the tab 
-  // (normal windows behavior is to discard presses of a UI element where the 
+  // Close tab on middle click, but only if the button is released over the tab
+  // (normal windows behavior is to discard presses of a UI element where the
   // releases happen off the element).
   if (event.IsMiddleMouseButton() && HitTest(event.location()))
     delegate_->CloseTab(this);
 }
 
 bool Tab::GetTooltipText(int x, int y, std::wstring* tooltip) {
   std::wstring title = GetTitle();
   if (!title.empty()) {
     // Only show the tooltip if the title is truncated.
     ChromeFont font;
@@ skipping 71 matching lines @@
 
   // Close out the path.
   path->lineTo(0, h);
   path->close();
 }
 
 void Tab::ContextMenuClosed() {
   delegate()->StopAllHighlighting();
   menu_controller_ = NULL;
 }