Check that child window was not destroyed inside UpdateTransientChildVisibility.

ui/wm/core/transient_window_manager.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/wm/core/transient_window_manager.h"
 
 #include <algorithm>
 #include <functional>
 
 #include "base/auto_reset.h"
 #include "base/stl_util.h"
 #include "ui/aura/window.h"
 #include "ui/aura/window_property.h"
+#include "ui/aura/window_tracker.h"
 #include "ui/wm/core/transient_window_observer.h"
 #include "ui/wm/core/transient_window_stacking_client.h"
 #include "ui/wm/core/window_util.h"
 
 using aura::Window;
 
 DECLARE_WINDOW_PROPERTY_TYPE(wm::TransientWindowManager*);
 
 namespace wm {
 namespace {
@@ skipping 131 matching lines @@
   }
 }
 
 void TransientWindowManager::OnWindowVisibilityChanged(Window* window,
                                                        bool visible) {
   if (window_ != window)
     return;
 
   // If the window has transient children, updates the transient children's
   // visiblity as well.
+  // WindowTracker is used because child window
+  // could be deleted inside UpdateTransientChildVisibility call.
+  aura::WindowTracker tracker;
   for (Window* child : transient_children_)
-    Get(child)->UpdateTransientChildVisibility(visible);
+    tracker.Add(child);
+
+  while (!tracker.windows().empty()) {
+    Window* window = *(tracker.windows().begin());
+    Get(window)->UpdateTransientChildVisibility(visible);
+    tracker.Remove(window);
+  }
 
   // Remember the show request in |show_on_parent_visible_| and hide it again
   // if the following conditions are met
   // - |parent_controls_visibility| is set to true.
   // - the window is hidden while the transient parent is not visible.
   // - Show/Hide was NOT called from TransientWindowManager.
   if (ignore_visibility_changed_event_ ||
       !transient_parent_ || !parent_controls_visibility_) {
     return;
   }
@@ skipping 36 matching lines @@
 
   // Destroy transient children, only after we've removed ourselves from our
   // parent, as destroying an active transient child may otherwise attempt to
   // refocus us.
   Windows transient_children(transient_children_);
   STLDeleteElements(&transient_children);
   DCHECK(transient_children_.empty());
 }
 
 }  // namespace wm