Fixes use after free caused by delete in RootWindowController

ash/root_window_controller.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ash/root_window_controller.h"
 
 #include <queue>
 #include <vector>
 
 #include "ash/ash_constants.h"
@@ skipping 419 matching lines @@
   if (shelf_->shelf_layout_manager())
     shelf_->shelf_layout_manager()->PrepareForShutdown();
 
   // Close background widget first as it depends on tooltip.
   wallpaper_controller_.reset();
   animating_wallpaper_controller_.reset();
 
   workspace_controller_.reset();
   aura::client::SetTooltipClient(root_window_.get(), NULL);
 
-  // Remove all toplevel windows first.
+  // Explicitly destroy top level windows. We do this as during part of
+  // destruction such windows may query the RootWindow for state.
   std::queue<aura::Window*> non_toplevel_windows;
   non_toplevel_windows.push(root_window_.get());
   while (!non_toplevel_windows.empty()) {
     aura::Window* non_toplevel_window = non_toplevel_windows.front();
     non_toplevel_windows.pop();
     aura::WindowTracker toplevel_windows;
     for (size_t i = 0; i < non_toplevel_window->children().size(); ++i) {
       aura::Window* child = non_toplevel_window->children()[i];
+      if (!child->owned_by_parent())
+        continue;
       if (child->delegate())
         toplevel_windows.Add(child);
       else
         non_toplevel_windows.push(child);
     }
     while (!toplevel_windows.windows().empty())
       delete *toplevel_windows.windows().begin();
   }
   // And then remove the containers.
-  while (!root_window_->children().empty())
-    delete root_window_->children()[0];
+  while (!root_window_->children().empty()) {
+    aura::Window* window = root_window_->children()[0];
+    if (window->owned_by_parent()) {
+      delete window;
+    } else {
+      root_window_->RemoveChild(window);
+    }
+  }
 
   shelf_.reset(NULL);
 }
 
 void RootWindowController::MoveWindowsTo(aura::RootWindow* dst) {
   // Forget the shelf early so that shelf don't update itself using wrong
   // display info.
   workspace_controller_->SetShelf(NULL);
   ReparentAllWindows(root_window_.get(), dst);
 }
@@ skipping 354 matching lines @@
     DisableTouchHudProjection();
 }
 
 RootWindowController* GetRootWindowController(
     const aura::RootWindow* root_window) {
   return root_window ? GetRootWindowSettings(root_window)->controller : NULL;
 }
 
 }  // namespace internal
 }  // namespace ash