We have a problem in the process on destroying WebContentsImpl because

content/public/browser/web_contents_observer.h

Index: content/public/browser/web_contents_observer.h
diff --git a/content/public/browser/web_contents_observer.h b/content/public/browser/web_contents_observer.h
index 9fae539faf6e3a97c3198e6d95a3e703202a7982..de85be5a548bff75e6fcc7d60088d898930f65aa 100644
--- a/content/public/browser/web_contents_observer.h
+++ b/content/public/browser/web_contents_observer.h
@@ -293,9 +293,9 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener,
                                         WebContents* new_web_contents) {}
 
   // Invoked when the WebContents is being destroyed. Gives subclasses a chance
-  // to cleanup. At the time this is invoked |web_contents()| returns NULL.
-  // It is safe to delete 'this' from here.
-  virtual void WebContentsDestroyed(WebContents* web_contents) {}
+  // to cleanup. After the whole loop over all WebContentsObservers
+  // has been finished, web_contents() returns NULL.

[jam, 2014/05/05 17:46:46]

nit: don't indent before hitting 80 chars

[zverre, 2014/05/06 09:37:26]

Done.

+  virtual void WebContentsDestroyed() {}
 
   // Called when the user agent override for a WebContents has been changed.
   virtual void UserAgentOverrideSet(const std::string& user_agent) {}
@@ -359,9 +359,9 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener,
  private:
   friend class WebContentsImpl;
 
-  // Invoked from WebContentsImpl. Invokes WebContentsDestroyed and NULL out
-  // |web_contents_|.
-  void WebContentsImplDestroyed();
+  // Resets |web_contents_| pointer to NULL as a final step in the process
+  // of destroying the WebContents. See comments near WebContentsDestroyed.

[jam, 2014/05/05 17:46:46]

no need to comment a simple setter, remove this whole comment

[zverre, 2014/05/06 09:37:26]

Done.

+  void reset_web_contents() { web_contents_ = NULL; }
 
   WebContentsImpl* web_contents_;