Allow for re-entrance in the notification manager.

chrome/browser/notifications/message_center_notification_manager.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/notifications/message_center_notification_manager.h"
 
 #include <memory>
 #include <utility>
 
 #include "base/logging.h"
@@ skipping 334 matching lines @@
     std::unique_ptr<ProfileNotification> profile_notification) {
   const Notification& notification = profile_notification->notification();
   std::string id = notification.id();
   // Notification ids should be unique.
   DCHECK(profile_notifications_.find(id) == profile_notifications_.end());
   profile_notifications_[id] = std::move(profile_notification);
 }
 
 void MessageCenterNotificationManager::RemoveProfileNotification(
     const std::string& notification_id) {
-  profile_notifications_.erase(notification_id);
+  auto it = profile_notifications_.find(notification_id);
+  if (it == profile_notifications_.end())
+    return;
+
+  // Delay destruction of the ProfileNotification until after all the work
+  // removing it from |profile_notifications_| is complete. This must be done
+  // because this ProfileNotification might have the one ScopedKeepAlive object
+  // that was keeping the browser alive, and destroying it would result in a re-
+  // entrant call to this class. Because every method in this class touches
+  // |profile_notifications_|, |profile_notifications_| must always be in a
+  // self-consistent state in moments where re-entrance might happen.
+  // https://crbug.com/649971
+  std::unique_ptr<ProfileNotification> notification = std::move(it->second);
+  profile_notifications_.erase(it);
+  // Now that the map modifications are complete, going out of scope will
+  // destroy the notification.
 }
 
 ProfileNotification* MessageCenterNotificationManager::FindProfileNotification(
     const std::string& id) const {
   auto iter = profile_notifications_.find(id);
   if (iter == profile_notifications_.end())
     return nullptr;
 
   return (*iter).second.get();
 }
@@ skipping 12 matching lines @@
        it != registry->enabled_extensions().end();
        ++it) {
     if ((*it->get()).permissions_data()->HasAPIPermission(
             extensions::APIPermission::ID::kNotificationProvider)) {
       extension_id = (*it->get()).id();
       return extension_id;
     }
   }
   return extension_id;
 }