Adds some debugging code in hopes of isolating bug 6316. I suspect the...

chrome/browser/tab_contents/render_view_host_manager.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/tab_contents/render_view_host_manager.h"
 
 #include "base/command_line.h"
 #include "base/logging.h"
 #include "chrome/browser/renderer_host/render_view_host.h"
 #include "chrome/browser/renderer_host/render_view_host_delegate.h"
 #include "chrome/browser/renderer_host/render_widget_host_view.h"
 #include "chrome/browser/tab_contents/navigation_controller.h"
 #include "chrome/browser/tab_contents/navigation_entry.h"
 #include "chrome/browser/tab_contents/site_instance.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/notification_service.h"
+#include "chrome/common/notification_type.h"
 
 namespace base {
 class WaitableEvent;
 }
 
 RenderViewHostManager::RenderViewHostManager(
     RenderViewHostFactory* render_view_factory,
     RenderViewHostDelegate* render_view_delegate,
     Delegate* delegate)
     : delegate_(delegate),
       cross_navigation_pending_(false),
       render_view_factory_(render_view_factory),
       render_view_delegate_(render_view_delegate),
       render_view_host_(NULL),
       pending_render_view_host_(NULL),
       interstitial_page_(NULL) {
+  registrar_.Add(this, NotificationType::RENDER_VIEW_HOST_DELETED,
+                 NotificationService::AllSources());
 }
 
 RenderViewHostManager::~RenderViewHostManager() {
   // Shutdown should have been called which should have cleaned these up.
   DCHECK(!render_view_host_);
   DCHECK(!pending_render_view_host_);
 }
 
 void RenderViewHostManager::Init(Profile* profile,
                                  SiteInstance* site_instance,
                                  int routing_id,
                                  base::WaitableEvent* modal_dialog_event) {
   // Create a RenderViewHost, once we have an instance.  It is important to
   // immediately give this SiteInstance to a RenderViewHost so that it is
   // ref counted.
   if (!site_instance)
     site_instance = SiteInstance::CreateSiteInstance(profile);
   render_view_host_ = CreateRenderViewHost(
       site_instance, routing_id, modal_dialog_event);
 }
 
 void RenderViewHostManager::Shutdown() {
   if (pending_render_view_host_)
     CancelPendingRenderView();
 
   // We should always have a main RenderViewHost.
-  render_view_host_->Shutdown();
+  RenderViewHost* render_view_host = render_view_host_;
   render_view_host_ = NULL;
+  render_view_host->Shutdown();
 }
 
 RenderViewHost* RenderViewHostManager::Navigate(const NavigationEntry& entry) {
   RenderViewHost* dest_render_view_host = UpdateRendererStateNavigate(entry);
   if (!dest_render_view_host)
     return NULL;  // We weren't able to create a pending render view host.
 
   // If the current render_view_host_ isn't live, we should create it so
   // that we don't show a sad tab while the dest_render_view_host fetches
   // its first page.  (Bug 1145340)
@@ skipping 167 matching lines @@
   }
 }
 
 void RenderViewHostManager::OnJavaScriptMessageBoxClosed(
     IPC::Message* reply_msg,
     bool success,
     const std::wstring& prompt) {
   render_view_host_->JavaScriptMessageBoxClosed(reply_msg, success, prompt);
 }
 
+void RenderViewHostManager::Observe(NotificationType type,
+                                    const NotificationSource& source,
+                                    const NotificationDetails& details) {
+  // Debugging code to help isolate
+  // http://code.google.com/p/chromium/issues/detail?id=6316 . We should never
+  // reference a RVH that is about to be deleted.
+  RenderViewHost* deleted_rvh = Source<RenderViewHost>(source).ptr();
+  CHECK(deleted_rvh);
+  CHECK(render_view_host_ != deleted_rvh);
+  CHECK(pending_render_view_host_ != deleted_rvh);
+}
 
 bool RenderViewHostManager::ShouldTransitionCrossSite() {
   // True if we are using process-per-site-instance (default) or
   // process-per-site (kProcessPerSite).
   return !CommandLine::ForCurrentProcess()->HasSwitch(switches::kProcessPerTab);
 }
 
 SiteInstance* RenderViewHostManager::GetSiteInstanceForEntry(
     const NavigationEntry& entry,
     SiteInstance* curr_instance) {
@@ skipping 243 matching lines @@
     return pending_render_view_host_;
   }
 
   // Same SiteInstance can be used.  Navigate render_view_host_ if we are not
   // cross navigating.
   DCHECK(!cross_navigation_pending_);
   return render_view_host_;
 }
 
 void RenderViewHostManager::CancelPendingRenderView() {
-  pending_render_view_host_->Shutdown();
+  RenderViewHost* pending_render_view_host = pending_render_view_host_;
   pending_render_view_host_ = NULL;
+  pending_render_view_host->Shutdown();
 }
 
 void RenderViewHostManager::CrossSiteNavigationCanceled() {
   DCHECK(cross_navigation_pending_);
   cross_navigation_pending_ = false;
   if (pending_render_view_host_)
     CancelPendingRenderView();
 }