This class is passed around as a raw pointer, and consumers make assumptions about the lifetime semantics.
Currently, TabStripModel assumes ownership of the WebContents in the tab strip, but also listens for destruction of the WebContents, in case the WebContents is deleted out from under the TabStripModel. This leads to invocations of callbacks on observers of the TabStripModel that use a half-destroyed WebContents.
I'm going to take a stab at this to see how terrible it will be to have clean ownership semantics in all of chrome.
Comment 1 by bugdroid1@chromium.org
, Apr 16 2018