Mac: Fix a crash in TextInputClientMac::GetFirstRectForRange() likely during tab closure

content/browser/renderer_host/render_widget_host_view_mac.mm

Index: content/browser/renderer_host/render_widget_host_view_mac.mm
diff --git a/content/browser/renderer_host/render_widget_host_view_mac.mm b/content/browser/renderer_host/render_widget_host_view_mac.mm
index ae60c419160f071682dfd6ea0bc1565eef2ad0bb..e94cf18559d800047ae5d0408f3e92858c42f682 100644
--- a/content/browser/renderer_host/render_widget_host_view_mac.mm
+++ b/content/browser/renderer_host/render_widget_host_view_mac.mm
@@ -2957,6 +2957,13 @@ extern NSString *NSTextInputReplacementRangeAttributeName;
 
 - (NSRect)firstRectForCharacterRange:(NSRange)theRange
                          actualRange:(NSRangePointer)actualRange {
+  // During tab closure, events can arrive after RenderWidgetHostViewMac::
+  // Destroy() is called, which will have set |render_widget_host_| to null.
+  if (!renderWidgetHostView_->render_widget_host_) {
+    [self cancelComposition];
+    return NSZeroRect;
+  }
+
   NSRect rect = [self firstViewRectForCharacterRange:theRange
                                          actualRange:actualRange];