Fix crash in WebContentsViewAura::WindowObserver that happens when switching tabs. The exact repro …

content/browser/web_contents/web_contents_view_aura.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/web_contents/web_contents_view_aura.h"
 
 #include "base/auto_reset.h"
 #include "base/command_line.h"
 #include "base/metrics/histogram.h"
 #include "base/strings/utf_string_conversions.h"
@@ skipping 781 matching lines @@
       window->GetRootWindow()->AddObserver(this);
 #endif
     }
   }
 
   virtual void OnWindowRemovingFromRootWindow(aura::Window* window) OVERRIDE {
     if (window == view_->window_) {
       window->GetDispatcher()->RemoveRootWindowObserver(this);
 #if defined(OS_WIN)
       window->GetRootWindow()->RemoveObserver(this);
+
+      const aura::Window::Windows& root_children =
+          window->GetRootWindow()->children();
+      for (size_t i = 0; i < root_children.size(); ++i) {
+        if (root_children[i] != view_->window_ && root_children[i] != parent_)
+          root_children[i]->RemoveObserver(this);
+      }
 #endif
     }
   }
 
   // Overridden RootWindowObserver:
   virtual void OnRootWindowHostMoved(const aura::RootWindow* root,
                                      const gfx::Point& new_origin) OVERRIDE {
     TRACE_EVENT1("ui",
                  "WebContentsViewAura::WindowObserver::OnRootWindowHostMoved",
                  "new_origin", new_origin.ToString());
@@ skipping 886 matching lines @@
       event.location(),
       gfx::Screen::GetScreenFor(GetNativeView())->GetCursorScreenPoint(),
       ConvertAuraEventFlagsToWebInputEventModifiers(event.flags()));
   if (drag_dest_delegate_)
     drag_dest_delegate_->OnDrop();
   current_drop_data_.reset();
   return current_drag_op_;
 }
 
 }  // namespace content