Fix Fullscreen Animation Crash

chrome/browser/ui/cocoa/browser_window_controller.mm

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "chrome/browser/ui/cocoa/browser_window_controller.h"
 
 #include <cmath>
 #include <numeric>
 #include <utility>
 
@@ skipping 440 matching lines @@
 
 - (void)dealloc {
   browser_->tab_strip_model()->CloseAllTabs();
 
   // Explicitly release |presentationModeController_| here, as it may call back
   // to this BWC in |-dealloc|.  We are required to call |-exitPresentationMode|
   // before releasing the controller.
   [presentationModeController_ exitPresentationMode];
   presentationModeController_.reset();
 
+  // Explicitly release |fullscreenTransition_| here since it may call back to
+  // this BWC in |-dealloc|. Reset the fullscreen variables.
+  if (fullscreenTransition_) {
+    [self resetCustomAppKitFullscreenVariables];
+    fullscreenTransition_.reset();

[Robert Sesek, 2016/04/01 20:04:05]

resetCustomAppKitFullscreenVariables does this too. But does this stop the
animation? Doesn't the CAAnimation hold a reference to the Transition object,
meaning that the Transition won't actually be dealloc'd here (until the
animation ends)?

[spqchan, 2016/04/04 16:36:16]

That's a good point, I removed all the animations from the layers before
reseting it.

I've been trying simulating the bug by killing the browser process during the
fullscreen transition and etc, but it doesn't seem like the most reliable way to
do it. Is there are good way for me to simulate this? Thanks!

+  }
+
   // Under certain testing configurations we may not actually own the browser.
   if (ownsBrowser_ == NO)
     ignore_result(browser_.release());
 
   [[NSNotificationCenter defaultCenter] removeObserver:self];
 
   // Inform reference counted objects that the Browser will be destroyed. This
   // ensures they invalidate their weak Browser* to prevent use-after-free.
   // These may outlive the Browser if they are retained by something else. For
   // example, since 10.10, the Nib loader internally creates an NSDictionary
@@ skipping 1637 matching lines @@
 
 - (BOOL)isTabbedWindow {
   return browser_->is_type_tabbed();
 }
 
 - (NSRect)savedRegularWindowFrame {
   return savedRegularWindowFrame_;
 }
 
 @end  // @implementation BrowserWindowController(WindowType)