Address a crash under -[NSWindow close] via a WeakPtr PostTask from Browser::TabStripEmpty()

chrome/browser/ui/cocoa/browser_window_cocoa.mm

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/cocoa/browser_window_cocoa.h"
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/logging.h"
 #import "base/mac/sdk_forward_declarations.h"
@@ skipping 114 matching lines @@
   [self validateText:[[notification object] stringValue]];
 }
 
 - (void)validateText:(NSString*)text {
   [control_ setEnabled:TrimText(text).empty() ? NO : YES];
 }
 @end
 
 BrowserWindowCocoa::BrowserWindowCocoa(Browser* browser,
                                        BrowserWindowController* controller)
-  : browser_(browser),
-    controller_(controller),
-    initial_show_state_(ui::SHOW_STATE_DEFAULT),
-    attention_request_id_(0) {
-
+    : browser_(browser),
+      controller_(controller),
+      initial_show_state_(ui::SHOW_STATE_DEFAULT),
+      attention_request_id_(0),
+      alert_state_(TabAlertState::NONE),
+      window_closed_(false) {
   gfx::Rect bounds;
   chrome::GetSavedWindowBoundsAndShowState(browser_,
                                            &bounds,
                                            &initial_show_state_);
 
   browser_->search_model()->AddObserver(this);
 }
 
 BrowserWindowCocoa::~BrowserWindowCocoa() {
   browser_->search_model()->RemoveObserver(this);
@@ skipping 604 matching lines @@
   // constructor or the FindBarCocoaController init, but that makes
   // unit testing difficult, since we would also require a
   // BrowserWindow object.
   FindBarBridge* bridge = new FindBarBridge(browser_);
   AddFindBar(bridge->find_bar_cocoa_controller());
   return bridge;
 }
 
 web_modal::WebContentsModalDialogHost*
     BrowserWindowCocoa::GetWebContentsModalDialogHost() {
-  DCHECK([controller_ window]);
+  DCHECK(window());
   ConstrainedWindowSheetController* sheet_controller =
-      [ConstrainedWindowSheetController
-          controllerForParentWindow:[controller_ window]];
+      [ConstrainedWindowSheetController controllerForParentWindow:window()];
   DCHECK(sheet_controller);
   return [sheet_controller dialogHost];
 }
 
 extensions::ActiveTabPermissionGranter*
     BrowserWindowCocoa::GetActiveTabPermissionGranter() {
   WebContents* web_contents =
       browser_->tab_strip_model()->GetActiveWebContents();
   if (!web_contents)
     return NULL;
   extensions::TabHelper* tab_helper =
       extensions::TabHelper::FromWebContents(web_contents);
   return tab_helper ? tab_helper->active_tab_permission_granter() : NULL;
 }
 
 void BrowserWindowCocoa::ModelChanged(const SearchModel::State& old_state,
                                       const SearchModel::State& new_state) {
 }
 
 void BrowserWindowCocoa::DestroyBrowser() {
   [controller_ destroyBrowser];
 
   // at this point the controller is dead (autoreleased), so
   // make sure we don't try to reference it any more.
 }
 
 NSWindow* BrowserWindowCocoa::window() const {
+  // AppKit doesn't seem to guarantee that [controller_ window] returns nil once
+  // the NSWindow is destroyed. Since |this| is deleted only once
+  // -[NSWindowController dealloc] completes, there's a possibility of
+  // a WeakPtr to Browser* requesting the NSWindow, which may be a zombie.
+  if (window_closed_)
+    return nil;
   return [controller_ window];
 }
 
 void BrowserWindowCocoa::ShowAvatarBubbleFromAvatarButton(
     AvatarBubbleMode mode,
     const signin::ManageAccountsParams& manage_accounts_params,
     signin_metrics::AccessPoint access_point) {
   profiles::BubbleViewMode bubble_view_mode;
   profiles::TutorialMode tutorial_mode;
   profiles::BubbleViewModeFromAvatarBubbleMode(mode, &bubble_view_mode,
@@ skipping 29 matching lines @@
 ExclusiveAccessContext* BrowserWindowCocoa::GetExclusiveAccessContext() {
   return [controller_ exclusiveAccessController];
 }
 
 void BrowserWindowCocoa::ShowImeWarningBubble(
     const extensions::Extension* extension,
     const base::Callback<void(ImeWarningBubblePermissionStatus status)>&
         callback) {
   NOTREACHED() << "The IME warning bubble is unsupported on this platform.";
 }
+
+void BrowserWindowCocoa::OnWindowWillClose() {
+  window_closed_ = true;
+}