PasswordController should give up on WebState destruction

ios/chrome/browser/passwords/password_controller.mm

Index: ios/chrome/browser/passwords/password_controller.mm
diff --git a/ios/chrome/browser/passwords/password_controller.mm b/ios/chrome/browser/passwords/password_controller.mm
index 1938757d5af90ad507bb7f9f11041de8b2e5c704..f6cabb7e6df4e793b13d2e59d8fa06549ebac57c 100644
--- a/ios/chrome/browser/passwords/password_controller.mm
+++ b/ios/chrome/browser/passwords/password_controller.mm
@@ -48,6 +48,13 @@ using password_manager::PasswordManager;
 using password_manager::PasswordManagerClient;
 using password_manager::PasswordManagerDriver;
 
+@interface PasswordController ()
+
+// This is set to YES as soon as the associated WebState is destroyed.
+@property(readonly) BOOL isWebStateDestroyed;
+
+@end
+
 @interface PasswordController ()<CRWWebStateObserver, FormSuggestionProvider>
 
 // Parses the |jsonString| which contatins the password forms found on a web
@@ -242,6 +249,8 @@ bool GetPageURLAndCheckTrustLevel(web::WebState* web_state, GURL* page_url) {
   scoped_ptr<web::WebStateObserverBridge> webStateObserverBridge_;
 }
 
+@synthesize isWebStateDestroyed = isWebStateDestroyed_;
+
 - (instancetype)initWithWebState:(web::WebState*)webState
              passwordsUiDelegate:(id<PasswordsUiDelegate>)UIDelegate {
   DCHECK(webState);
@@ -364,7 +373,7 @@ bool GetPageURLAndCheckTrustLevel(web::WebState* web_state, GURL* page_url) {
   // the race.
   // TODO(crbug.com/418827): Fix this by passing in more data from the JS side.
   id completionHandler = ^(BOOL found, const autofill::PasswordForm& form) {
-    if (weakSelf) {
+    if (weakSelf && ![weakSelf isWebStateDestroyed]) {
       weakSelf.get()->passwordManager_->OnPasswordFormSubmitted(
           weakSelf.get()->passwordManagerDriver_.get(), form);
     }
@@ -374,6 +383,7 @@ bool GetPageURLAndCheckTrustLevel(web::WebState* web_state, GURL* page_url) {
 }
 
 - (void)webStateDestroyed:(web::WebState*)webState {
+  isWebStateDestroyed_ = YES;
   [self detach];
 }