Mac: Fix a crash in TextInputClientMac::GetFirstRectForRange() likely during tab closure

content/browser/renderer_host/render_widget_host_view_mac.mm

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/render_widget_host_view_mac.h"
 
 #import <objc/runtime.h>
 #include <OpenGL/gl.h>
 #include <QuartzCore/QuartzCore.h>
 
@@ skipping 2939 matching lines @@
 
   // The returned rectangle is in WebKit coordinates (upper left origin), so
   // flip the coordinate system.
   NSRect viewFrame = [self frame];
   rect.origin.y = NSHeight(viewFrame) - NSMaxY(rect);
   return rect;
 }
 
 - (NSRect)firstRectForCharacterRange:(NSRange)theRange
                          actualRange:(NSRangePointer)actualRange {
+  // During tab closure, events can arrive after RenderWidgetHostViewMac::
+  // Destroy() is called, which will have set |render_widget_host_| to null.
+  if (!renderWidgetHostView_->render_widget_host_) {
+    [self cancelComposition];
+    return NSZeroRect;
+  }
+
   NSRect rect = [self firstViewRectForCharacterRange:theRange
                                          actualRange:actualRange];
 
   // Convert into screen coordinates for return.
   rect = [self convertRect:rect toView:nil];
   rect.origin = [[self window] convertBaseToScreen:rect.origin];
   return rect;
 }
 
 - (NSRange)markedRange {
@@ skipping 439 matching lines @@
 
 // "-webkit-app-region: drag | no-drag" is implemented on Mac by excluding
 // regions that are not draggable. (See ControlRegionView in
 // native_app_window_cocoa.mm). This requires the render host view to be
 // draggable by default.
 - (BOOL)mouseDownCanMoveWindow {
   return YES;
 }
 
 @end