To reproduce crashes of JSONPrefStore

chrome/browser/safe_browsing/safe_browsing_service.cc

Index: chrome/browser/safe_browsing/safe_browsing_service.cc
diff --git a/chrome/browser/safe_browsing/safe_browsing_service.cc b/chrome/browser/safe_browsing/safe_browsing_service.cc
index ce6cb4def26772497f10c0638b56e37d837d451d..7a870d4fad98a5dec885860a3a0799f9b6fc75a5 100644
--- a/chrome/browser/safe_browsing/safe_browsing_service.cc
+++ b/chrome/browser/safe_browsing/safe_browsing_service.cc
@@ -609,8 +609,9 @@ void SafeBrowsingService::Observe(int type,
     case chrome::NOTIFICATION_PROFILE_DESTROYED: {
       DCHECK_CURRENTLY_ON(BrowserThread::UI);
       Profile* profile = content::Source<Profile>(source).ptr();
+      PrefService* pref_service = profile->GetPrefs();
       if (!profile->IsOffTheRecord())
-        RemovePrefService(profile->GetPrefs());
+        RemovePrefService(pref_service);
       break;
     }
     default:
@@ -642,12 +643,12 @@ void SafeBrowsingService::AddPrefService(PrefService* pref_service) {
 }
 
 void SafeBrowsingService::RemovePrefService(PrefService* pref_service) {
+  // If the profile fails to initialize, then |pref_service| was not added
+  // before, and therefore there is nothing to remove.
   if (prefs_map_.find(pref_service) != prefs_map_.end()) {
     delete prefs_map_[pref_service];
     prefs_map_.erase(pref_service);
     RefreshState();
-  } else {
-    NOTREACHED();
   }
 }