Address a crash under -[NSWindow close] via a WeakPtr PostTask from Browser::TabStripEmpty()

chrome/browser/ui/cocoa/browser_window_cocoa.mm

Index: chrome/browser/ui/cocoa/browser_window_cocoa.mm
diff --git a/chrome/browser/ui/cocoa/browser_window_cocoa.mm b/chrome/browser/ui/cocoa/browser_window_cocoa.mm
index 11b6485b8c278c6ea9ee7723dd62f2a305bc0a3e..8a26e926bbe3f41c2f25f4452ed50cadff92df26 100644
--- a/chrome/browser/ui/cocoa/browser_window_cocoa.mm
+++ b/chrome/browser/ui/cocoa/browser_window_cocoa.mm
@@ -132,11 +132,12 @@ base::string16 TrimText(NSString* controlText) {
 
 BrowserWindowCocoa::BrowserWindowCocoa(Browser* browser,
                                        BrowserWindowController* controller)
-  : browser_(browser),
-    controller_(controller),
-    initial_show_state_(ui::SHOW_STATE_DEFAULT),
-    attention_request_id_(0) {
-
+    : browser_(browser),
+      controller_(controller),
+      initial_show_state_(ui::SHOW_STATE_DEFAULT),
+      attention_request_id_(0),
+      alert_state_(TabAlertState::NONE),
+      window_closed_(false) {
   gfx::Rect bounds;
   chrome::GetSavedWindowBoundsAndShowState(browser_,
                                            &bounds,
@@ -761,10 +762,9 @@ FindBar* BrowserWindowCocoa::CreateFindBar() {
 
 web_modal::WebContentsModalDialogHost*
     BrowserWindowCocoa::GetWebContentsModalDialogHost() {
-  DCHECK([controller_ window]);
+  DCHECK(window());
   ConstrainedWindowSheetController* sheet_controller =
-      [ConstrainedWindowSheetController
-          controllerForParentWindow:[controller_ window]];
+      [ConstrainedWindowSheetController controllerForParentWindow:window()];
   DCHECK(sheet_controller);
   return [sheet_controller dialogHost];
 }
@@ -792,6 +792,12 @@ void BrowserWindowCocoa::DestroyBrowser() {
 }
 
 NSWindow* BrowserWindowCocoa::window() const {
+  // AppKit doesn't seem to guarantee that [controller_ window] returns nil once
+  // the NSWindow is destroyed. Since |this| is deleted only once
+  // -[NSWindowController dealloc] completes, there's a possibility of
+  // a WeakPtr to Browser* requesting the NSWindow, which may be a zombie.
+  if (window_closed_)
+    return nil;
   return [controller_ window];
 }
 
@@ -841,3 +847,7 @@ void BrowserWindowCocoa::ShowImeWarningBubble(
         callback) {
   NOTREACHED() << "The IME warning bubble is unsupported on this platform.";
 }
+
+void BrowserWindowCocoa::OnWindowWillClose() {
+  window_closed_ = true;
+}