Avoid memory corruption in sessions sync

chrome/browser/sync/glue/synced_session_tracker.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/logging.h"
 #include "base/stl_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "chrome/browser/sync/glue/synced_session_tracker.h"
 
 namespace browser_sync {
@@ skipping 268 matching lines @@
   // the tab_node_ids are not always available when processing headers.
   // We know that we will eventually process (via GetTab) every single tab node
   // in the system, so we permit ourselves to use kInvalidTabNodeID here and
   // rely on the later update to build the mapping (or a restart).
   // TODO(tim): Bug 98892. Update comment when Sync API conversion finishes to
   // mention that in the meantime, the only ill effect is that we may not be
   // able to fully clean up a stale foreign session, but it will get garbage
   // collected eventually.
   SessionTab* tab_ptr = GetTabImpl(
       session_tag, tab_id, TabNodePool::kInvalidTabNodeID);
+
+  // It's up to the caller to ensure this never happens.  Tabs should not
+  // belong to more than one window or appear twice within the same window.
+  //
+  // If this condition were violated, we would double-free during shutdown.
+  // That could cause all sorts of hard to diagnose crashes, possibly in code
+  // far away from here.  We crash early to avoid this.
+  //
+  // See http://crbug.com/360822.
+  CHECK(!synced_tab_map_[session_tag][tab_id].owned);
+
   unmapped_tabs_.erase(tab_ptr);
   synced_tab_map_[session_tag][tab_id].owned = true;
+
   tab_ptr->window_id.set_id(window_id);
   DVLOG(1) << "  - tab " << tab_id << " added to window "<< window_id;
   DCHECK(GetSession(session_tag)->windows.find(window_id) !=
          GetSession(session_tag)->windows.end());
   std::vector<SessionTab*>& window_tabs =
       GetSession(session_tag)->windows[window_id]->tabs;
   if (window_tabs.size() <= tab_index) {
     window_tabs.resize(tab_index+1, NULL);
   }
   DCHECK(!window_tabs[tab_index]);
@@ skipping 80 matching lines @@
 
   // Get rid of our Window/Tab maps (does not delete the actual Window/Tabs
   // themselves; they should have all been deleted above).
   synced_window_map_.clear();
   synced_tab_map_.clear();
 
   local_session_tag_.clear();
 }
 
 }  // namespace browser_sync