Do not use TabModel inside BlockedPopupInfo handler block.

ios/chrome/browser/tabs/tab.mm

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "ios/chrome/browser/tabs/tab.h"
 
 #import <CoreLocation/CoreLocation.h>
 #import <UIKit/UIKit.h>
 
 #include <utility>
@@ skipping 1476 matching lines @@
 }
 
 - (void)blockPopupForURL:(const GURL&)popupURL
                openerURL:(const GURL&)openerURL {
   web::NavigationItem* item = [self navigationManager]->GetLastCommittedItem();
   web::Referrer referrer(openerURL, item->GetReferrer().policy);
   GURL localPopupURL(popupURL);
   base::WeakNSObject<Tab> weakSelf(self);
   // TODO(crbug.com/692117): Remove |window_name| from constructor.
   web::BlockedPopupInfo poupInfo(popupURL, referrer, nil /* window_name */, ^{
-    base::scoped_nsobject<Tab> strongSelf([weakSelf retain]);
-    if (!strongSelf) {
-      return;
+    web::WebState* webState = [weakSelf webState];
+    if (webState) {
+      web::WebState::OpenURLParams params(
+          localPopupURL, referrer, WindowOpenDisposition::NEW_POPUP,
+          ui::PAGE_TRANSITION_LINK, true /* is_renderer_initiated */);
+      params.url = localPopupURL;
+      params.referrer = referrer;
+      params.transition = ui::PAGE_TRANSITION_LINK;
+      webState->OpenURL(params);
     }
-    [strongSelf updateSnapshotWithOverlay:YES visibleFrameOnly:YES];
-    [strongSelf.get()->parentTabModel_
-        insertOrUpdateTabWithURL:localPopupURL
-                        referrer:referrer
-                      transition:ui::PAGE_TRANSITION_LINK
-                      windowName:nil
-                          opener:self
-                     openedByDOM:YES
-                         atIndex:TabModelConstants::kTabPositionAutomatically
-                    inBackground:NO];
   });
   BlockedPopupTabHelper::FromWebState(self.webState)->HandlePopup(poupInfo);
 }
 
 #pragma mark -
 #pragma mark FindInPageControllerDelegate
 
 - (void)willAdjustScrollPosition {
   // Skip the next attempt to correct the scroll offset for the toolbar height.
   // Used when programatically scrolling down the y offset.
@@ skipping 702 matching lines @@
 
 - (TabModel*)parentTabModel {
   return parentTabModel_;
 }
 
 - (FormInputAccessoryViewController*)inputAccessoryViewController {
   return inputAccessoryViewController_.get();
 }
 
 @end