Reversed WebState <-> CRWWebController ownership.

ios/web/web_state/web_state_impl.h

Index: ios/web/web_state/web_state_impl.h
diff --git a/ios/web/web_state/web_state_impl.h b/ios/web/web_state/web_state_impl.h
index 9d5578aa64419610fb0a8456a536f0ed43a7a73f..ef0a0cc95116797c28155235ac043db184c586ce 100644
--- a/ios/web/web_state/web_state_impl.h
+++ b/ios/web/web_state/web_state_impl.h
@@ -62,9 +62,8 @@ class WebStateImpl : public WebState, public NavigationManagerDelegate {
   WebStateImpl(BrowserState* browser_state);
   ~WebStateImpl() override;
 
-  // Sets the CRWWebController that backs this object. Typically
-  // |web_controller| will also take ownership of this object. This will also
-  // create the WebContentsIOS facade.
+  // Gets/Sets the CRWWebController that backs this object.
+  CRWWebController* GetWebController();
   void SetWebController(CRWWebController* web_controller);
 
   // Gets or sets the delegate used to communicate with the web contents facade.
@@ -287,8 +286,8 @@ class WebStateImpl : public WebState, public NavigationManagerDelegate {
   // The delegate used to pass state to the web contents facade.
   WebStateFacadeDelegate* facade_delegate_;
 
-  // The CRWWebController that backs and owns this object.
-  CRWWebController* web_controller_;
+  // The CRWWebController that backs this object.
+  base::scoped_nsobject<CRWWebController> web_controller_;
 
   NavigationManagerImpl navigation_manager_;