Paper over a crash that I think is due to the way we shut down the view hiera...

chrome/views/custom_frame_window.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/views/custom_frame_window.h"
 
 #include "base/gfx/point.h"
 #include "base/gfx/size.h"
 #include "base/win_util.h"
 #include "chrome/app/theme/theme_resources.h"
@@ skipping 656 matching lines @@
   // The bottom of the titlebar actually comes from the top of the Client Edge
   // graphic, with the actual client edge clipped off the bottom.
   SkBitmap* titlebar_bottom = resources()->GetPartBitmap(FRAME_CLIENT_EDGE_TOP);
   int edge_height = titlebar_bottom->height() - kClientEdgeThickness;
   canvas->TileImageInt(*titlebar_bottom, 0,
       container_->client_view()->y() - edge_height, width(), edge_height);
 }
 
 void DefaultNonClientView::PaintTitleBar(ChromeCanvas* canvas) {
   WindowDelegate* d = container_->window_delegate();
+
+  // It seems like in some conditions we can be asked to paint after the window
+  // that contains us is WM_DESTROYed. At this point, our delegate is NULL. The
+  // correct long term fix may be to shut down the RootView in WM_DESTROY.
+  if (!d)
+    return;
+
   canvas->DrawStringInt(d->GetWindowTitle(), title_font_, SK_ColorWHITE,
       MirroredLeftPointForRect(title_bounds_), title_bounds_.y(),
       title_bounds_.width(), title_bounds_.height());
 }
 
 void DefaultNonClientView::PaintRestoredClientEdge(ChromeCanvas* canvas) {
   gfx::Rect client_area_bounds = container_->client_view()->bounds();
   int client_area_top = client_area_bounds.y();
 
   SkBitmap* top_left = resources()->GetPartBitmap(FRAME_CLIENT_EDGE_TOP_LEFT);
@@ skipping 634 matching lines @@
   if ((GetKeyState(VK_CONTROL) & 0x80) == 0x80)
     message_flags |= MK_CONTROL;
   if ((GetKeyState(VK_SHIFT) & 0x80) == 0x80)
     message_flags |= MK_SHIFT;
   message_flags |= flags;
   ProcessMousePressed(temp, message_flags, false);
 }
 
 }  // namespace views