Store a stacktrace of PrefService destruction in PrefChangeRegistrar

base/prefs/pref_member.cc

Index: base/prefs/pref_member.cc
diff --git a/base/prefs/pref_member.cc b/base/prefs/pref_member.cc
index eb708394979964615eec8db0c9222ae0de220632..68fca85ce423f828ff309f56dc7cbfa377ab064b 100644
--- a/base/prefs/pref_member.cc
+++ b/base/prefs/pref_member.cc
@@ -6,6 +6,8 @@
 
 #include "base/callback.h"
 #include "base/callback_helpers.h"
+// TODO(battre): Delete this. See crbug.com/373435.
+#include "base/debug/alias.h"
 #include "base/location.h"
 #include "base/prefs/pref_service.h"
 #include "base/value_conversions.h"
@@ -47,6 +49,18 @@ void PrefMemberBase::Init(const char* pref_name,
 
 void PrefMemberBase::Destroy() {
   if (prefs_ && !pref_name_.empty()) {
+    // TODO(battre): Delete this. See crbug.com/373435.
+    if (!pref_service_destruction_.empty()) {
+      // The PrefService is already destroyed, so the following call to
+      // service_->RemovePrefObserver would crash anyway. When the PrefService
+      // was destroyed, it stored a stack trace of the destruction in
+      // pref_service_destruction_. We save this on the stack in the minidump to
+      // understand what happens.
+      char tmp[2048] = {};
+      strncat(tmp, pref_service_destruction_.c_str(), sizeof(tmp) - 1u);
+      base::debug::Alias(tmp);
+      CHECK(false) << tmp;
+    }
     prefs_->RemovePrefObserver(pref_name_.c_str(), this);
     prefs_ = NULL;
   }
@@ -68,6 +82,12 @@ void PrefMemberBase::OnPreferenceChanged(PrefService* service,
       base::Bind(observer_, pref_name) : base::Closure());
 }
 
+// TODO(battre): Delete this. See crbug.com/373435.
+void PrefMemberBase::SetPrefServiceDestructionTrace(
+    const std::string& stack_trace) {
+  pref_service_destruction_ = stack_trace;
+}
+
 void PrefMemberBase::UpdateValueFromPref(const base::Closure& callback) const {
   VerifyValuePrefName();
   const PrefService::Preference* pref =