[Mac] Inform reference counted objects that hold a weak Browser* when the Browser is being destroye…

chrome/browser/ui/cocoa/browser_window_controller.mm

Index: chrome/browser/ui/cocoa/browser_window_controller.mm
diff --git a/chrome/browser/ui/cocoa/browser_window_controller.mm b/chrome/browser/ui/cocoa/browser_window_controller.mm
index 022763ca1412a4b4ba2c130be2538e380bedeaf3..466f9863ef1399ad05cb23cc6d36a2e384a2133f 100644
--- a/chrome/browser/ui/cocoa/browser_window_controller.mm
+++ b/chrome/browser/ui/cocoa/browser_window_controller.mm
@@ -302,7 +302,7 @@ using content::WebContents;
     // Create the overlayable contents controller.  This provides the switch
     // view that TabStripController needs.
     overlayableContentsController_.reset(
-        [[OverlayableContentsController alloc] initWithBrowser:browser]);
+        [[OverlayableContentsController alloc] init]);
     [[overlayableContentsController_ view]
         setFrame:[[devToolsController_ view] bounds]];
     [[devToolsController_ view]
@@ -439,6 +439,17 @@ using content::WebContents;
 
   [[NSNotificationCenter defaultCenter] removeObserver:self];
 
+  // Inform reference counted objects that the Browser will be destroyed. This
+  // ensures they invalidate their weak Browser* to prevent use-after-free.
+  // These may outlive the Browser if they are retained by something else, e.g.
+  // an autorelease NSView or an NSEvent.

[tapted, 2015/07/07 04:25:59]

You could mention here, something like,

For example, since 10.10, the Nib loader internally creates an NSDictionary
referencing views/controllers which is autoreleased, so there is no way to
guarantee that the [super dealloc] call below will also call dealloc on the
controllers.

[jackhou1, 2015/07/07 08:33:05]

Done.

+  [toolbarController_ browserWillBeDestroyed];
+  [tabStripController_ browserWillBeDestroyed];
+  [findBarCocoaController_ browserWillBeDestroyed];
+  [downloadShelfController_ browserWillBeDestroyed];
+  [bookmarkBarController_ browserWillBeDestroyed];
+  [avatarButtonController_ browserWillBeDestroyed];
+
   [super dealloc];
 }