Fixes use after free caused by delete in RootWindowController

ash/root_window_controller.cc

Index: ash/root_window_controller.cc
diff --git a/ash/root_window_controller.cc b/ash/root_window_controller.cc
index 3b36a710965dc96bd43d78c610f0cb55e440cc7e..3703532012664d301e6322302e67ad80b5747334 100644
--- a/ash/root_window_controller.cc
+++ b/ash/root_window_controller.cc
@@ -451,12 +451,25 @@ void RootWindowController::CloseChildWindows() {
       else
         non_toplevel_windows.push(child);
     }
-    while (!toplevel_windows.windows().empty())
-      delete *toplevel_windows.windows().begin();
+    while (!toplevel_windows.windows().empty()) {
+      aura::Window* window = *(toplevel_windows.windows().begin());
+      if (window->owned_by_parent()) {
+        delete window;
+      } else {
+        toplevel_windows.Remove(window);
+        window->parent()->RemoveChild(window);
+      }
+    }
   }
   // And then remove the containers.
-  while (!root_window_->children().empty())
-    delete root_window_->children()[0];
+  while (!root_window_->children().empty()) {
+    aura::Window* window = root_window_->children()[0];
+    if (window->owned_by_parent()) {
+      delete window;
+    } else {
+      root_window_->RemoveChild(window);
+    }
+  }
 
   shelf_.reset(NULL);
 }