We have a problem in the process on destroying WebContentsImpl because

each WebContentsObserver first NULLs its web_contents_ pointer and
performs cleanup code after that.

This could work if we guaranteed that every WebContentsObserver doesn't
directly or indirectly affect any other WebContentsObserver. But
actually WebContentsObservers can do anything and also affect each
other. And if one WebContentsObserver already NULLed its web_contents_
pointer (e.g. ZoomController) other WebContentsObserver
(e.g. InterstitialPageImpl) calls it (indirectly in this case) we have
problems and result depends on ordering of WebContentsObservers in the
list of observers.

The solution splits that process into two phases. First we let each
WebContentsObserver to perform their cleanup code and at that point they
can freely call each other, we completely don't care about the ordering.
We can call this phase as untrusted phase because we deal with some cleanup
code that can do anything. After that we make second pass and NULL each
web_contents_ pointer and this phase is trusted because we call only private
implementation of WebContentsObserver that we definitely can trust.

BUG=363564

Review URL: https://codereview.chromium.org/257153003

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@269264 0039d316-1c4b-4281-b951-d872f2087c98

34 files changed, 58 insertions, 98 deletions

diff --git a/chrome/browser/ui/android/infobars/auto_login_prompter.cc b/chrome/browser/ui/android/infobars/auto_login_prompter.cc
index 2cc1f24..7d50998 100644
--- a/chrome/browser/ui/android/infobars/auto_login_prompter.cc
+++ b/chrome/browser/ui/android/infobars/auto_login_prompter.cc
@@ -97,7 +97,7 @@ void AutoLoginPrompter::DidStopLoading(
   delete this;
 }
 
-void AutoLoginPrompter::WebContentsDestroyed(WebContents* web_contents) {
+void AutoLoginPrompter::WebContentsDestroyed() {
   // The WebContents was destroyed before the navigation completed.
   delete this;
 }
diff --git a/chrome/browser/ui/android/infobars/auto_login_prompter.h b/chrome/browser/ui/android/infobars/auto_login_prompter.h
index d55eb67..bfeb290 100644
--- a/chrome/browser/ui/android/infobars/auto_login_prompter.h
+++ b/chrome/browser/ui/android/infobars/auto_login_prompter.h
@@ -53,8 +53,7 @@ class AutoLoginPrompter : public content::WebContentsObserver {
   virtual void DidStopLoading(
       content::RenderViewHost* render_view_host) OVERRIDE;
 
-  virtual void WebContentsDestroyed(
-      content::WebContents* web_contents) OVERRIDE;
+  virtual void WebContentsDestroyed() OVERRIDE;
 
   // Add the infobar to the WebContents, if it's still needed.
   void AddInfoBarToWebContents();
diff --git a/chrome/browser/ui/ash/launcher/browser_status_monitor.cc b/chrome/browser/ui/ash/launcher/browser_status_monitor.cc
index f10792c..36b1935 100644
--- a/chrome/browser/ui/ash/launcher/browser_status_monitor.cc
+++ b/chrome/browser/ui/ash/launcher/browser_status_monitor.cc
@@ -60,14 +60,11 @@ class BrowserStatusMonitor::LocalWebContentsObserver
       monitor_->SetShelfIDForBrowserWindowContents(browser, web_contents());
   }
 
-  virtual void WebContentsDestroyed(
-      content::WebContents* web_content) OVERRIDE {
-    if (web_content == web_contents()) {
-      // We can only come here when there was a non standard termination like
-      // an app got un-installed while running, etc.
-      monitor_->WebContentsDestroyed(web_content);
-      // |this| is gone now.
-    }
+  virtual void WebContentsDestroyed() OVERRIDE {
+    // We can only come here when there was a non standard termination like
+    // an app got un-installed while running, etc.
+    monitor_->WebContentsDestroyed(web_contents());
+    // |this| is gone now.
   }
 
  private:
diff --git a/chrome/browser/ui/ash/launcher/chrome_launcher_controller_unittest.cc b/chrome/browser/ui/ash/launcher/chrome_launcher_controller_unittest.cc
index b0b4a01..887cf81 100644
--- a/chrome/browser/ui/ash/launcher/chrome_launcher_controller_unittest.cc
+++ b/chrome/browser/ui/ash/launcher/chrome_launcher_controller_unittest.cc
@@ -683,8 +683,7 @@ class WebContentsDestroyedWatcher : public content::WebContentsObserver {
 
  private:
   // Overridden WebContentsObserver methods.
-  virtual void WebContentsDestroyed(
-      content::WebContents* web_contents) OVERRIDE {
+  virtual void WebContentsDestroyed() OVERRIDE {
     message_loop_runner_->Quit();
   }
 
diff --git a/chrome/browser/ui/auto_login_infobar_delegate.cc b/chrome/browser/ui/auto_login_infobar_delegate.cc
index 1149029..62dffb6 100644
--- a/chrome/browser/ui/auto_login_infobar_delegate.cc
+++ b/chrome/browser/ui/auto_login_infobar_delegate.cc
@@ -63,8 +63,7 @@ class AutoLoginRedirector : public UbertokenConsumer,
   virtual void OnUbertokenFailure(const GoogleServiceAuthError& error) OVERRIDE;
 
   // Implementation of content::WebContentsObserver
-  virtual void WebContentsDestroyed(
-      content::WebContents* web_contents) OVERRIDE;
+  virtual void WebContentsDestroyed() OVERRIDE;
 
   // Redirect tab to MergeSession URL, logging the user in and navigating
   // to the desired page.
@@ -97,8 +96,7 @@ AutoLoginRedirector::AutoLoginRedirector(
 AutoLoginRedirector::~AutoLoginRedirector() {
 }
 
-void AutoLoginRedirector::WebContentsDestroyed(
-    content::WebContents* web_contents) {
+void AutoLoginRedirector::WebContentsDestroyed() {
   // The WebContents that started this has been destroyed. The request must be
   // cancelled and this object must be deleted.
   ubertoken_fetcher_.reset();
diff --git a/chrome/browser/ui/autofill/autofill_popup_controller_interactive_uitest.cc b/chrome/browser/ui/autofill/autofill_popup_controller_interactive_uitest.cc
index fd4573f..9b8f81b 100644
--- a/chrome/browser/ui/autofill/autofill_popup_controller_interactive_uitest.cc
+++ b/chrome/browser/ui/autofill/autofill_popup_controller_interactive_uitest.cc
@@ -72,31 +72,27 @@ class AutofillPopupControllerBrowserTest
   virtual ~AutofillPopupControllerBrowserTest() {}
 
   virtual void SetUpOnMainThread() OVERRIDE {
-    web_contents_ = browser()->tab_strip_model()->GetActiveWebContents();
-    ASSERT_TRUE(web_contents_ != NULL);
-    Observe(web_contents_);
+    content::WebContents* web_contents =
+        browser()->tab_strip_model()->GetActiveWebContents();
+    ASSERT_TRUE(web_contents != NULL);
+    Observe(web_contents);
 
     ContentAutofillDriver* driver =
-        ContentAutofillDriver::FromWebContents(web_contents_);
+        ContentAutofillDriver::FromWebContents(web_contents);
     autofill_external_delegate_.reset(
        new TestAutofillExternalDelegate(
-           web_contents_,
+           web_contents,
            driver->autofill_manager(),
            driver));
   }
 
   // Normally the WebContents will automatically delete the delegate, but here
   // the delegate is owned by this test, so we have to manually destroy.
-  virtual void WebContentsDestroyed(content::WebContents* web_contents)
-      OVERRIDE {
-    DCHECK_EQ(web_contents_, web_contents);
-
+  virtual void WebContentsDestroyed() OVERRIDE {
     autofill_external_delegate_.reset();
   }
 
  protected:
-  content::WebContents* web_contents_;
-
   scoped_ptr<TestAutofillExternalDelegate> autofill_external_delegate_;
 };
 
diff --git a/chrome/browser/ui/autofill/tab_autofill_manager_delegate.cc b/chrome/browser/ui/autofill/tab_autofill_manager_delegate.cc
index 2b9fccc..0e1c45d 100644
--- a/chrome/browser/ui/autofill/tab_autofill_manager_delegate.cc
+++ b/chrome/browser/ui/autofill/tab_autofill_manager_delegate.cc
@@ -167,8 +167,7 @@ void TabAutofillManagerDelegate::HideRequestAutocompleteDialog() {
     dialog_controller_->Hide();
 }
 
-void TabAutofillManagerDelegate::WebContentsDestroyed(
-    content::WebContents* web_contents) {
+void TabAutofillManagerDelegate::WebContentsDestroyed() {
   HideAutofillPopup();
 }
 
diff --git a/chrome/browser/ui/autofill/tab_autofill_manager_delegate.h b/chrome/browser/ui/autofill/tab_autofill_manager_delegate.h
index 3b3a3f0..6c48706 100644
--- a/chrome/browser/ui/autofill/tab_autofill_manager_delegate.h
+++ b/chrome/browser/ui/autofill/tab_autofill_manager_delegate.h
@@ -70,8 +70,7 @@ class TabAutofillManagerDelegate
       const base::string16& profile_full_name) OVERRIDE;
 
   // content::WebContentsObserver implementation.
-  virtual void WebContentsDestroyed(
-      content::WebContents* web_contents) OVERRIDE;
+  virtual void WebContentsDestroyed() OVERRIDE;
 
   // Exposed for testing.
   AutofillDialogController* GetDialogControllerForTesting() {
diff --git a/chrome/browser/ui/blocked_content/popup_blocker_browsertest.cc b/chrome/browser/ui/blocked_content/popup_blocker_browsertest.cc
index 5b275b1..bc21ac4 100644
--- a/chrome/browser/ui/blocked_content/popup_blocker_browsertest.cc
+++ b/chrome/browser/ui/blocked_content/popup_blocker_browsertest.cc
@@ -81,7 +81,7 @@ class CloseObserver : public content::WebContentsObserver {
     close_loop_.Run();
   }
 
-  virtual void WebContentsDestroyed(WebContents* contents) OVERRIDE {
+  virtual void WebContentsDestroyed() OVERRIDE {
     close_loop_.Quit();
   }
 
diff --git a/chrome/browser/ui/browser_browsertest.cc b/chrome/browser/ui/browser_browsertest.cc
index 89015cb..96cf626 100644
--- a/chrome/browser/ui/browser_browsertest.cc
+++ b/chrome/browser/ui/browser_browsertest.cc
@@ -631,7 +631,7 @@ class RedirectObserver : public content::WebContentsObserver {
     params_ = params;
   }
 
-  virtual void WebContentsDestroyed(WebContents* contents) OVERRIDE {
+  virtual void WebContentsDestroyed() OVERRIDE {
     // Make sure we don't close the tab while the observer is in scope.
     // See http://crbug.com/314036.
     FAIL() << "WebContents closed during navigation (http://crbug.com/314036).";
diff --git a/chrome/browser/ui/cocoa/hung_renderer_controller.mm b/chrome/browser/ui/cocoa/hung_renderer_controller.mm
index 524e5b4..5035873 100644
--- a/chrome/browser/ui/cocoa/hung_renderer_controller.mm
+++ b/chrome/browser/ui/cocoa/hung_renderer_controller.mm
@@ -51,7 +51,7 @@ class WebContentsObserverBridge : public content::WebContentsObserver {
   virtual void RenderProcessGone(base::TerminationStatus status) OVERRIDE {
     [controller_ renderProcessGone];
   }
-  virtual void WebContentsDestroyed(WebContents* tab) OVERRIDE {
+  virtual void WebContentsDestroyed() OVERRIDE {
     [controller_ renderProcessGone];
   }
 
diff --git a/chrome/browser/ui/omnibox/omnibox_navigation_observer.cc b/chrome/browser/ui/omnibox/omnibox_navigation_observer.cc
index 9e5a44a..51a19b7 100644
--- a/chrome/browser/ui/omnibox/omnibox_navigation_observer.cc
+++ b/chrome/browser/ui/omnibox/omnibox_navigation_observer.cc
@@ -108,8 +108,7 @@ void OmniboxNavigationObserver::NavigationEntryCommitted(
     OnAllLoadingFinished();  // deletes |this|!
 }
 
-void OmniboxNavigationObserver::WebContentsDestroyed(
-    content::WebContents* web_contents) {
+void OmniboxNavigationObserver::WebContentsDestroyed() {
   delete this;
 }
 
diff --git a/chrome/browser/ui/omnibox/omnibox_navigation_observer.h b/chrome/browser/ui/omnibox/omnibox_navigation_observer.h
index 8253173..0b80411 100644
--- a/chrome/browser/ui/omnibox/omnibox_navigation_observer.h
+++ b/chrome/browser/ui/omnibox/omnibox_navigation_observer.h
@@ -82,8 +82,7 @@ class OmniboxNavigationObserver : public content::NotificationObserver,
       content::NavigationController::ReloadType reload_type) OVERRIDE;
   virtual void NavigationEntryCommitted(
       const content::LoadCommittedDetails& load_details) OVERRIDE;
-  virtual void WebContentsDestroyed(
-      content::WebContents* web_contents) OVERRIDE;
+  virtual void WebContentsDestroyed() OVERRIDE;
 
   // net::URLFetcherDelegate:
   virtual void OnURLFetchComplete(const net::URLFetcher* source) OVERRIDE;
diff --git a/chrome/browser/ui/panels/panel_host.cc b/chrome/browser/ui/panels/panel_host.cc
index 9d8bbd3..670ae73 100644
--- a/chrome/browser/ui/panels/panel_host.cc
+++ b/chrome/browser/ui/panels/panel_host.cc
@@ -208,7 +208,7 @@ void PanelHost::RenderProcessGone(base::TerminationStatus status) {
   CloseContents(web_contents_.get());
 }
 
-void PanelHost::WebContentsDestroyed(content::WebContents* web_contents) {
+void PanelHost::WebContentsDestroyed() {
   // Web contents should only be destroyed by us.
   CHECK(!web_contents_.get());
 
diff --git a/chrome/browser/ui/panels/panel_host.h b/chrome/browser/ui/panels/panel_host.h
index 217d228..3277c3b 100644
--- a/chrome/browser/ui/panels/panel_host.h
+++ b/chrome/browser/ui/panels/panel_host.h
@@ -80,8 +80,7 @@ class PanelHost : public content::WebContentsDelegate,
   virtual void RenderViewCreated(
       content::RenderViewHost* render_view_host) OVERRIDE;
   virtual void RenderProcessGone(base::TerminationStatus status) OVERRIDE;
-  virtual void WebContentsDestroyed(
-      content::WebContents* web_contents) OVERRIDE;
+  virtual void WebContentsDestroyed() OVERRIDE;
   virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
 
   // extensions::ExtensionFunctionDispatcher::Delegate overrides.
diff --git a/chrome/browser/ui/passwords/manage_passwords_bubble_model.cc b/chrome/browser/ui/passwords/manage_passwords_bubble_model.cc
index 96e9e62..6eca416 100644
--- a/chrome/browser/ui/passwords/manage_passwords_bubble_model.cc
+++ b/chrome/browser/ui/passwords/manage_passwords_bubble_model.cc
@@ -19,12 +19,11 @@ using content::WebContents;
 ManagePasswordsBubbleModel::ManagePasswordsBubbleModel(
     content::WebContents* web_contents)
     : content::WebContentsObserver(web_contents),
-      web_contents_(web_contents),
       display_disposition_(
           password_manager::metrics_util::AUTOMATIC_WITH_PASSWORD_PENDING),
       dismissal_reason_(password_manager::metrics_util::NOT_DISPLAYED) {
   ManagePasswordsUIController* controller =
-      ManagePasswordsUIController::FromWebContents(web_contents_);
+      ManagePasswordsUIController::FromWebContents(web_contents);
 
   // TODO(mkwst): Reverse this logic. The controller should populate the model
   // directly rather than the model pulling from the controller. Perhaps like
@@ -83,7 +82,7 @@ void ManagePasswordsBubbleModel::OnNopeClicked() {
 void ManagePasswordsBubbleModel::OnNeverForThisSiteClicked() {
   dismissal_reason_ = password_manager::metrics_util::CLICKED_NEVER;
   ManagePasswordsUIController* manage_passwords_ui_controller =
-      ManagePasswordsUIController::FromWebContents(web_contents_);
+      ManagePasswordsUIController::FromWebContents(web_contents());
   manage_passwords_ui_controller->NeverSavePassword();
   state_ = password_manager::ui::BLACKLIST_STATE;
 }
@@ -91,7 +90,7 @@ void ManagePasswordsBubbleModel::OnNeverForThisSiteClicked() {
 void ManagePasswordsBubbleModel::OnUnblacklistClicked() {
   dismissal_reason_ = password_manager::metrics_util::CLICKED_UNBLACKLIST;
   ManagePasswordsUIController* manage_passwords_ui_controller =
-      ManagePasswordsUIController::FromWebContents(web_contents_);
+      ManagePasswordsUIController::FromWebContents(web_contents());
   manage_passwords_ui_controller->UnblacklistSite();
   state_ = password_manager::ui::MANAGE_STATE;
 }
@@ -99,7 +98,7 @@ void ManagePasswordsBubbleModel::OnUnblacklistClicked() {
 void ManagePasswordsBubbleModel::OnSaveClicked() {
   dismissal_reason_ = password_manager::metrics_util::CLICKED_SAVE;
   ManagePasswordsUIController* manage_passwords_ui_controller =
-      ManagePasswordsUIController::FromWebContents(web_contents_);
+      ManagePasswordsUIController::FromWebContents(web_contents());
   manage_passwords_ui_controller->SavePassword();
   state_ = password_manager::ui::MANAGE_STATE;
 }
@@ -110,17 +109,17 @@ void ManagePasswordsBubbleModel::OnDoneClicked() {
 
 void ManagePasswordsBubbleModel::OnManageLinkClicked() {
   dismissal_reason_ = password_manager::metrics_util::CLICKED_MANAGE;
-  ManagePasswordsUIController::FromWebContents(web_contents_)
+  ManagePasswordsUIController::FromWebContents(web_contents())
       ->NavigateToPasswordManagerSettingsPage();
 }
 
 void ManagePasswordsBubbleModel::OnPasswordAction(
     const autofill::PasswordForm& password_form,
     PasswordAction action) {
-  if (!web_contents_)
+  if (!web_contents())
     return;
   Profile* profile =
-      Profile::FromBrowserContext(web_contents_->GetBrowserContext());
+      Profile::FromBrowserContext(web_contents()->GetBrowserContext());
   password_manager::PasswordStore* password_store =
       PasswordStoreFactory::GetForProfile(profile, Profile::EXPLICIT_ACCESS)
           .get();
@@ -130,9 +129,3 @@ void ManagePasswordsBubbleModel::OnPasswordAction(
   else
     password_store->AddLogin(password_form);
 }
-
-void ManagePasswordsBubbleModel::WebContentsDestroyed(
-    content::WebContents* web_contents) {
-  // The WebContents have been destroyed.
-  web_contents_ = NULL;
-}
diff --git a/chrome/browser/ui/passwords/manage_passwords_bubble_model.h b/chrome/browser/ui/passwords/manage_passwords_bubble_model.h
index 1fc6c68..e6ae6aa 100644
--- a/chrome/browser/ui/passwords/manage_passwords_bubble_model.h
+++ b/chrome/browser/ui/passwords/manage_passwords_bubble_model.h
@@ -89,11 +89,6 @@ class ManagePasswordsBubbleModel : public content::WebContentsObserver {
 #endif
 
  private:
-  // content::WebContentsObserver
-  virtual void WebContentsDestroyed(
-      content::WebContents* web_contents) OVERRIDE;
-
-  content::WebContents* web_contents_;
   password_manager::ui::State state_;
   base::string16 title_;
   autofill::PasswordForm pending_credentials_;
diff --git a/chrome/browser/ui/passwords/manage_passwords_ui_controller.cc b/chrome/browser/ui/passwords/manage_passwords_ui_controller.cc
index 3b192d9..00378fa 100644
--- a/chrome/browser/ui/passwords/manage_passwords_ui_controller.cc
+++ b/chrome/browser/ui/passwords/manage_passwords_ui_controller.cc
@@ -81,10 +81,9 @@ void ManagePasswordsUIController::OnBlacklistBlockedAutofill(
   UpdateBubbleAndIconVisibility();
 }
 
-void ManagePasswordsUIController::WebContentsDestroyed(
-    content::WebContents* web_contents) {
+void ManagePasswordsUIController::WebContentsDestroyed() {
   password_manager::PasswordStore* password_store =
-      GetPasswordStore(web_contents);
+      GetPasswordStore(web_contents());
   if (password_store)
     password_store->RemoveObserver(this);
 }
diff --git a/chrome/browser/ui/passwords/manage_passwords_ui_controller.h b/chrome/browser/ui/passwords/manage_passwords_ui_controller.h
index 35977d4..eed1a64 100644
--- a/chrome/browser/ui/passwords/manage_passwords_ui_controller.h
+++ b/chrome/browser/ui/passwords/manage_passwords_ui_controller.h
@@ -115,8 +115,7 @@ class ManagePasswordsUIController
   virtual void DidNavigateMainFrame(
       const content::LoadCommittedDetails& details,
       const content::FrameNavigateParams& params) OVERRIDE;
-  virtual void WebContentsDestroyed(
-      content::WebContents* web_contents) OVERRIDE;
+  virtual void WebContentsDestroyed() OVERRIDE;
 
   // Set by OnPasswordSubmitted() when the user submits a form containing login
   // information.  If the user responds to a subsequent "Do you want to save
diff --git a/chrome/browser/ui/sync/one_click_signin_helper.cc b/chrome/browser/ui/sync/one_click_signin_helper.cc
index fceb3e6..7e4fdfe 100644
--- a/chrome/browser/ui/sync/one_click_signin_helper.cc
+++ b/chrome/browser/ui/sync/one_click_signin_helper.cc
@@ -426,7 +426,7 @@ class CurrentHistoryCleaner : public content::WebContentsObserver {
   virtual ~CurrentHistoryCleaner();
 
   // content::WebContentsObserver:
-  virtual void WebContentsDestroyed(content::WebContents* contents) OVERRIDE;
+  virtual void WebContentsDestroyed() OVERRIDE;
   virtual void DidCommitProvisionalLoadForFrame(
       int64 frame_id,
       const base::string16& frame_unique_name,
@@ -479,8 +479,7 @@ void CurrentHistoryCleaner::DidCommitProvisionalLoadForFrame(
   }
 }
 
-void CurrentHistoryCleaner::WebContentsDestroyed(
-    content::WebContents* contents) {
+void CurrentHistoryCleaner::WebContentsDestroyed() {
   delete this;  // Failure.
 }
 
diff --git a/chrome/browser/ui/sync/one_click_signin_sync_observer.cc b/chrome/browser/ui/sync/one_click_signin_sync_observer.cc
index 376baeb..96c45c5 100644
--- a/chrome/browser/ui/sync/one_click_signin_sync_observer.cc
+++ b/chrome/browser/ui/sync/one_click_signin_sync_observer.cc
@@ -51,9 +51,8 @@ OneClickSigninSyncObserver::OneClickSigninSyncObserver(
 
 OneClickSigninSyncObserver::~OneClickSigninSyncObserver() {}
 
-void OneClickSigninSyncObserver::WebContentsDestroyed(
-    content::WebContents* web_contents) {
-  ProfileSyncService* sync_service = GetSyncService(web_contents);
+void OneClickSigninSyncObserver::WebContentsDestroyed() {
+  ProfileSyncService* sync_service = GetSyncService(web_contents());
   if (sync_service)
     sync_service->RemoveObserver(this);
 
diff --git a/chrome/browser/ui/sync/one_click_signin_sync_observer.h b/chrome/browser/ui/sync/one_click_signin_sync_observer.h
index 7d53a77..23dca83 100644
--- a/chrome/browser/ui/sync/one_click_signin_sync_observer.h
+++ b/chrome/browser/ui/sync/one_click_signin_sync_observer.h
@@ -31,7 +31,7 @@ class OneClickSigninSyncObserver : public content::WebContentsObserver,
 
  private:
   // content::WebContentsObserver:
-  virtual void WebContentsDestroyed(content::WebContents* contents) OVERRIDE;
+  virtual void WebContentsDestroyed() OVERRIDE;
 
   // ProfileSyncServiceObserver:
   virtual void OnStateChanged() OVERRIDE;
diff --git a/chrome/browser/ui/tab_contents/core_tab_helper.cc b/chrome/browser/ui/tab_contents/core_tab_helper.cc
index 99f93b2..d30bbaf 100644
--- a/chrome/browser/ui/tab_contents/core_tab_helper.cc
+++ b/chrome/browser/ui/tab_contents/core_tab_helper.cc
@@ -150,7 +150,7 @@ void CoreTabHelper::WasShown() {
       web_contents()->GetRenderProcessHost()->GetID());
 }
 
-void CoreTabHelper::WebContentsDestroyed(WebContents* web_contents) {
+void CoreTabHelper::WebContentsDestroyed() {
   // OnCloseStarted isn't called in unit tests.
   if (!close_start_time_.is_null()) {
     bool fast_tab_close_enabled = CommandLine::ForCurrentProcess()->HasSwitch(
diff --git a/chrome/browser/ui/tab_contents/core_tab_helper.h b/chrome/browser/ui/tab_contents/core_tab_helper.h
index a5ca820..e01482b 100644
--- a/chrome/browser/ui/tab_contents/core_tab_helper.h
+++ b/chrome/browser/ui/tab_contents/core_tab_helper.h
@@ -59,8 +59,7 @@ class CoreTabHelper : public content::WebContentsObserver,
   virtual void DidStartLoading(
       content::RenderViewHost* render_view_host) OVERRIDE;
   virtual void WasShown() OVERRIDE;
-  virtual void WebContentsDestroyed(
-      content::WebContents* web_contents) OVERRIDE;
+  virtual void WebContentsDestroyed() OVERRIDE;
   virtual void BeforeUnloadFired(const base::TimeTicks& proceed_time) OVERRIDE;
   virtual void BeforeUnloadDialogCancelled() OVERRIDE;
   virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
diff --git a/chrome/browser/ui/tabs/tab_strip_model.cc b/chrome/browser/ui/tabs/tab_strip_model.cc
index 06ac829..098d89d 100644
--- a/chrome/browser/ui/tabs/tab_strip_model.cc
+++ b/chrome/browser/ui/tabs/tab_strip_model.cc
@@ -73,7 +73,7 @@ class CloseTracker {
 
    private:
     // WebContentsObserver:
-    virtual void WebContentsDestroyed(WebContents* web_contents) OVERRIDE {
+    virtual void WebContentsDestroyed() OVERRIDE {
       parent_->OnWebContentsDestroyed(this);
     }
 
@@ -161,7 +161,7 @@ class TabStripModel::WebContentsData : public content::WebContentsObserver {
  private:
   // Make sure that if someone deletes this WebContents out from under us, it
   // is properly removed from the tab strip.
-  virtual void WebContentsDestroyed(WebContents* web_contents) OVERRIDE;
+  virtual void WebContentsDestroyed() OVERRIDE;
 
   // The WebContents being tracked by this WebContentsData. The
   // WebContentsObserver does keep a reference, but when the WebContents is
@@ -224,13 +224,12 @@ void TabStripModel::WebContentsData::SetWebContents(WebContents* contents) {
   Observe(contents);
 }
 
-void TabStripModel::WebContentsData::WebContentsDestroyed(
-    WebContents* web_contents) {
-  DCHECK_EQ(contents_, web_contents);
+void TabStripModel::WebContentsData::WebContentsDestroyed() {
+  DCHECK_EQ(contents_, web_contents());
 
   // Note that we only detach the contents here, not close it - it's
   // already been closed. We just want to undo our bookkeeping.
-  int index = tab_strip_model_->GetIndexOfWebContents(web_contents);
+  int index = tab_strip_model_->GetIndexOfWebContents(web_contents());
   DCHECK_NE(TabStripModel::kNoTab, index);
   tab_strip_model_->DetachWebContentsAt(index);
 }
diff --git a/chrome/browser/ui/tabs/tab_strip_model_unittest.cc b/chrome/browser/ui/tabs/tab_strip_model_unittest.cc
index 4c43196..1bbfaea 100644
--- a/chrome/browser/ui/tabs/tab_strip_model_unittest.cc
+++ b/chrome/browser/ui/tabs/tab_strip_model_unittest.cc
@@ -58,7 +58,7 @@ class DeleteWebContentsOnDestroyedObserver
         tab_strip_(tab_strip) {
   }
 
-  virtual void WebContentsDestroyed(WebContents* web_contents) OVERRIDE {
+  virtual void WebContentsDestroyed() OVERRIDE {
     WebContents* tab_to_delete = tab_to_delete_;
     tab_to_delete_ = NULL;
     TabStripModel* tab_strip_to_delete = tab_strip_;
diff --git a/chrome/browser/ui/views/frame/browser_view_browsertest.cc b/chrome/browser/ui/views/frame/browser_view_browsertest.cc
index 236e774..e573e1b 100644
--- a/chrome/browser/ui/views/frame/browser_view_browsertest.cc
+++ b/chrome/browser/ui/views/frame/browser_view_browsertest.cc
@@ -26,8 +26,7 @@ class TestWebContentsObserver : public content::WebContentsObserver {
         other_(other) {}
   virtual ~TestWebContentsObserver() {}
 
-  virtual void WebContentsDestroyed(
-      content::WebContents* web_contents) OVERRIDE {
+  virtual void WebContentsDestroyed() OVERRIDE {
     other_->NotifyNavigationStateChanged(
         content::INVALIDATE_TYPE_URL | content::INVALIDATE_TYPE_LOAD);
   }
diff --git a/chrome/browser/ui/views/hung_renderer_view.cc b/chrome/browser/ui/views/hung_renderer_view.cc
index bb9b873..5f3242a 100644
--- a/chrome/browser/ui/views/hung_renderer_view.cc
+++ b/chrome/browser/ui/views/hung_renderer_view.cc
@@ -155,8 +155,7 @@ void HungPagesTableModel::WebContentsObserverImpl::RenderProcessGone(
   model_->TabDestroyed(this);
 }
 
-void HungPagesTableModel::WebContentsObserverImpl::WebContentsDestroyed(
-    WebContents* tab) {
+void HungPagesTableModel::WebContentsObserverImpl::WebContentsDestroyed() {
   model_->TabDestroyed(this);
 }
 
diff --git a/chrome/browser/ui/views/hung_renderer_view.h b/chrome/browser/ui/views/hung_renderer_view.h
index 2f4c945..2f661af 100644
--- a/chrome/browser/ui/views/hung_renderer_view.h
+++ b/chrome/browser/ui/views/hung_renderer_view.h
@@ -75,7 +75,7 @@ class HungPagesTableModel : public ui::TableModel, public views::TableGrouper {
 
     // WebContentsObserver overrides:
     virtual void RenderProcessGone(base::TerminationStatus status) OVERRIDE;
-    virtual void WebContentsDestroyed(content::WebContents* tab) OVERRIDE;
+    virtual void WebContentsDestroyed() OVERRIDE;
 
    private:
     HungPagesTableModel* model_;
diff --git a/chrome/browser/ui/views/translate/translate_bubble_view.cc b/chrome/browser/ui/views/translate/translate_bubble_view.cc
index ba6c6bd..2608055 100644
--- a/chrome/browser/ui/views/translate/translate_bubble_view.cc
+++ b/chrome/browser/ui/views/translate/translate_bubble_view.cc
@@ -261,8 +261,7 @@ void TranslateBubbleView::LinkClicked(views::Link* source, int event_flags) {
   HandleLinkClicked(static_cast<LinkID>(source->id()));
 }
 
-void TranslateBubbleView::WebContentsDestroyed(
-    content::WebContents* web_contents) {
+void TranslateBubbleView::WebContentsDestroyed() {
   GetWidget()->CloseNow();
 }
 
diff --git a/chrome/browser/ui/views/translate/translate_bubble_view.h b/chrome/browser/ui/views/translate/translate_bubble_view.h
index 39d066b..91b38a37 100644
--- a/chrome/browser/ui/views/translate/translate_bubble_view.h
+++ b/chrome/browser/ui/views/translate/translate_bubble_view.h
@@ -70,8 +70,7 @@ class TranslateBubbleView : public views::BubbleDelegateView,
   virtual void LinkClicked(views::Link* source, int event_flags) OVERRIDE;
 
   // content::WebContentsObserver method.
-  virtual void WebContentsDestroyed(content::WebContents* web_contents)
-      OVERRIDE;
+  virtual void WebContentsDestroyed() OVERRIDE;
 
   // Returns the current view state.
   TranslateBubbleModel::ViewState GetViewState() const;
diff --git a/chrome/browser/ui/website_settings/permission_bubble_manager.cc b/chrome/browser/ui/website_settings/permission_bubble_manager.cc
index 9eec3bb..8816cee 100644
--- a/chrome/browser/ui/website_settings/permission_bubble_manager.cc
+++ b/chrome/browser/ui/website_settings/permission_bubble_manager.cc
@@ -234,8 +234,7 @@ void PermissionBubbleManager::NavigationEntryCommitted(
   }
 }
 
-void PermissionBubbleManager::WebContentsDestroyed(
-    content::WebContents* web_contents) {
+void PermissionBubbleManager::WebContentsDestroyed() {
   // If the web contents has been destroyed, treat the bubble as cancelled.
   CancelPendingQueue();
   FinalizeBubble();
@@ -243,7 +242,7 @@ void PermissionBubbleManager::WebContentsDestroyed(
   // The WebContents is going away; be aggressively paranoid and delete
   // ourselves lest other parts of the system attempt to add permission bubbles
   // or use us otherwise during the destruction.
-  web_contents->RemoveUserData(UserDataKey());
+  web_contents()->RemoveUserData(UserDataKey());
   // That was the equivalent of "delete this". This object is now destroyed;
   // returning from this function is the only safe thing to do.
 }
diff --git a/chrome/browser/ui/website_settings/permission_bubble_manager.h b/chrome/browser/ui/website_settings/permission_bubble_manager.h
index 767037e..2e0eafc 100644
--- a/chrome/browser/ui/website_settings/permission_bubble_manager.h
+++ b/chrome/browser/ui/website_settings/permission_bubble_manager.h
@@ -74,8 +74,7 @@ class PermissionBubbleManager
   // they will be finalized as if canceled by the user.
   virtual void NavigationEntryCommitted(
       const content::LoadCommittedDetails& details) OVERRIDE;
-  virtual void WebContentsDestroyed(
-      content::WebContents* web_contents) OVERRIDE;
+  virtual void WebContentsDestroyed() OVERRIDE;
 
   // PermissionBubbleView::Delegate:
   virtual void ToggleAccept(int request_index, bool new_value) OVERRIDE;
diff --git a/chrome/browser/ui/webui/constrained_web_dialog_ui_browsertest.cc b/chrome/browser/ui/webui/constrained_web_dialog_ui_browsertest.cc
index 9890575..ba8e0e5 100644
--- a/chrome/browser/ui/webui/constrained_web_dialog_ui_browsertest.cc
+++ b/chrome/browser/ui/webui/constrained_web_dialog_ui_browsertest.cc
@@ -33,7 +33,7 @@ class ConstrainedWebDialogBrowserTestObserver
   bool contents_destroyed() { return contents_destroyed_; }
 
  private:
-  virtual void WebContentsDestroyed(WebContents* tab) OVERRIDE {
+  virtual void WebContentsDestroyed() OVERRIDE {
     contents_destroyed_ = true;
   }