Hide autofill popup before WebContentsImpl is destroyed.

chrome/browser/ui/autofill/tab_autofill_manager_delegate.cc

Index: chrome/browser/ui/autofill/tab_autofill_manager_delegate.cc
diff --git a/chrome/browser/ui/autofill/tab_autofill_manager_delegate.cc b/chrome/browser/ui/autofill/tab_autofill_manager_delegate.cc
index c66528c4d44008c916807bff84ae52325561006d..aa1c8b163258136bda8db0f8087e16b8e8119667 100644
--- a/chrome/browser/ui/autofill/tab_autofill_manager_delegate.cc
+++ b/chrome/browser/ui/autofill/tab_autofill_manager_delegate.cc
@@ -38,7 +38,11 @@ TabAutofillManagerDelegate::TabAutofillManagerDelegate(
 }
 
 TabAutofillManagerDelegate::~TabAutofillManagerDelegate() {
-  HideAutofillPopup();
+  // NOTE: It is too late to clean up the autofill popup; that cleanup process
+  // requires that the WebContents instance still be valid and it is not at
+  // this point (in particular, the WebContentsImpl destructor has already
+  // finished running and we are now in the base class destructor).
+  DCHECK(!popup_controller_.get());

[Ilya Sherman, 2013/07/03 19:56:49]

nit: I don't think the ".get()" is needed here.

[blundell, 2013/07/04 08:32:45]

Done.

 }
 
 PersonalDataManager* TabAutofillManagerDelegate::GetPersonalDataManager() {
@@ -205,4 +209,9 @@ void TabAutofillManagerDelegate::DidNavigateMainFrame(
   HideAutocheckoutBubble();
 }
 
+void TabAutofillManagerDelegate::WebContentsDestroyed(
+    content::WebContents* web_contents) {
+  HideAutofillPopup();
+}
+
 }  // namespace autofill