Add a CHECK when an object tries to remove itself as an observer from Notific...

chrome/common/notification_service.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/common/notification_service.h"
 
 #include "base/lazy_instance.h"
 #include "base/thread_local.h"
 
 static base::LazyInstance<base::ThreadLocalPointer<NotificationService> >
@@ skipping 42 matching lines @@
   observer_list->AddObserver(observer);
 #ifndef NDEBUG
   ++observer_counts_[type.value];
 #endif
 }
 
 void NotificationService::RemoveObserver(NotificationObserver* observer,
                                          NotificationType type,
                                          const NotificationSource& source) {
   DCHECK(type.value < NotificationType::NOTIFICATION_TYPE_COUNT);
-  DCHECK(HasKey(observers_[type.value], source));
+
+  // This is a very serious bug.  An object is most likely being deleted on
+  // the wrong thread, and as a result another thread's NotificationService
+  // has its deleted pointer in its map.  A garbge object will be called in the
+  // future.
+  // NOTE: when this check shows crashes, use ChromeThread::DeleteOnIOThread or
+  // other variants as the trait on the object.
+  CHECK(HasKey(observers_[type.value], source));
 
   NotificationObserverList* observer_list =
       observers_[type.value][source.map_key()];
   if (observer_list) {
     observer_list->RemoveObserver(observer);
 #ifndef NDEBUG
     --observer_counts_[type.value];
 #endif
   }
 
@@ skipping 60 matching lines @@
   for (int i = 0; i < NotificationType::NOTIFICATION_TYPE_COUNT; i++) {
     NotificationSourceMap omap = observers_[i];
     for (NotificationSourceMap::iterator it = omap.begin();
          it != omap.end(); ++it) {
       delete it->second;
     }
   }
 }
 
 NotificationObserver::~NotificationObserver() {}