Speculative fix for crash. Crashes seem to indicate

ExtensionsTabModule is asking for the id of a deleted TabContents. My guess is
ExtensionWebNavigationTabObserver is adding an entry for a TabContents
that is later deleted and ExtensionWebNavigationTabObserver doesn't
clean up it's map so that if another TabContents ends up with the same
pointer value we get a crash.

BUG=91385
TEST=none
R=jochen@chromium.org

Review URL: http://codereview.chromium.org/7562003

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@95818 0039d316-1c4b-4281-b951-d872f2087c98

chrome/browser/extensions/extension_webnavigation_api.cc

@@ -344,6 +344,9 @@ void ExtensionWebNavigationEventRouter::Init() {
     registrar_.Add(this,
                    content::NOTIFICATION_TAB_ADDED,
                    NotificationService::AllSources());
+    registrar_.Add(this,
+                   content::NOTIFICATION_TAB_CONTENTS_DESTROYED,
+                   NotificationService::AllSources());
   }
 }
 
@@ -360,6 +363,10 @@ void ExtensionWebNavigationEventRouter::Observe(
       TabAdded(Details<TabContents>(details).ptr());
       break;
 
+    case content::NOTIFICATION_TAB_CONTENTS_DESTROYED:
+      TabDestroyed(Source<TabContents>(source).ptr());
+      break;
+
     default:
       NOTREACHED();
   }
@@ -419,6 +426,17 @@ void ExtensionWebNavigationEventRouter::TabAdded(TabContents* tab_contents) {
   pending_tab_contents_.erase(iter);
 }
 
+void ExtensionWebNavigationEventRouter::TabDestroyed(
+    TabContents* tab_contents) {
+  pending_tab_contents_.erase(tab_contents);
+  for (std::map<TabContents*, PendingTabContents>::iterator i =
+           pending_tab_contents_.begin(); i != pending_tab_contents_.end(); ) {
+    if (i->second.source_tab_contents == tab_contents)
+      pending_tab_contents_.erase(i++);
+    else
+      ++i;
+  }
+}
 
 // ExtensionWebNavigationTabObserver ------------------------------------------
 

chrome/browser/extensions/extension_webnavigation_api.h

@@ -198,6 +198,10 @@ class ExtensionWebNavigationEventRouter : public NotificationObserver {
   // of such an event and creates a JSON formated extension event from it.
   void TabAdded(TabContents* tab_contents);
 
+  // Handler for NOTIFICATION_TAB_CONTENTS_DESTROYED. If |tab_contents| is
+  // in |pending_tab_contents_|, it is removed.
+  void TabDestroyed(TabContents* tab_contents);
+
   // Mapping pointers to TabContents objects to information about how they got
   // created.
   std::map<TabContents*, PendingTabContents> pending_tab_contents_;