Candidate fix for observe-window-after-free error in WindowTreeClientImpl::LocalSetCapture

components/mus/public/cpp/lib/window_tree_client_impl.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef COMPONENTS_MUS_PUBLIC_CPP_LIB_WINDOW_TREE_CLIENT_IMPL_H_
 #define COMPONENTS_MUS_PUBLIC_CPP_LIB_WINDOW_TREE_CLIENT_IMPL_H_
 
 #include <stdint.h>
 
 #include <map>
@@ skipping 115 matching lines @@
   // the last step of ~Window).
   void OnWindowDestroyed(Window* window);
 
   Window* GetWindowByServerId(Id id);
 
   // WindowTreeConnection:
   Window* GetCaptureWindow() override;
 
  private:
   friend class WindowTreeClientImplPrivate;
+  class MusWindowObserver;
 
   enum class NewWindowType {
     CHILD,
     TOP_LEVEL,
   };
 
   using IdToWindowMap = std::map<Id, Window*>;
 
   // TODO(sky): this assumes change_ids never wrap, which is a bad assumption.
   using InFlightMap = std::map<uint32_t, std::unique_ptr<InFlightChange>>;
 
   // Returns the oldest InFlightChange that matches |change|.
   InFlightChange* GetOldestInFlightChangeMatching(const InFlightChange& change);
 
+  void SetCaptureWindow(Window* window);
+
   // See InFlightChange for details on how InFlightChanges are used.
   uint32_t ScheduleInFlightChange(std::unique_ptr<InFlightChange> change);
 
   // Returns true if there is an InFlightChange that matches |change|. If there
   // is an existing change SetRevertValueFrom() is invoked on it. Returns false
   // if there is no InFlightChange matching |change|.
   // See InFlightChange for details on how InFlightChanges are used.
   bool ApplyServerChangeToExistingInFlightChange(const InFlightChange& change);
 
   Window* NewWindowImpl(NewWindowType type,
@@ skipping 121 matching lines @@
   InFlightMap in_flight_map_;
 
   WindowTreeDelegate* delegate_;
 
   WindowManagerDelegate* window_manager_delegate_;
 
   std::set<Window*> roots_;
 
   IdToWindowMap windows_;
 
-  Window* capture_window_;
+  std::unique_ptr<MusWindowObserver> capture_window_observer_;
 
   Window* focused_window_;
 
   mojo::Binding<WindowTreeClient> binding_;
   mojom::WindowTreePtr tree_ptr_;
   // Typically this is the value contained in |tree_ptr_|, but tests may
   // directly set this.
   mojom::WindowTree* tree_;
 
   bool delete_on_no_roots_;
@@ skipping 20 matching lines @@
   uint32_t event_observer_id_ = 0u;
 
   base::WeakPtrFactory<WindowTreeClientImpl> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(WindowTreeClientImpl);
 };
 
 }  // namespace mus
 
 #endif  // COMPONENTS_MUS_PUBLIC_CPP_LIB_WINDOW_TREE_CLIENT_IMPL_H_