Do not use TabModel inside BlockedPopupInfo handler block.

ios/chrome/browser/ui/browser_view_controller.mm

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "ios/chrome/browser/ui/browser_view_controller.h"
 
 #import <AssetsLibrary/AssetsLibrary.h>
 #import <MobileCoreServices/MobileCoreServices.h>
 #import <PassKit/PassKit.h>
 #import <Photos/Photos.h>
@@ skipping 2358 matching lines @@
       return tab.webState;
     }
     case WindowOpenDisposition::CURRENT_TAB: {
       web::NavigationManager::WebLoadParams loadParams(params.url);
       loadParams.referrer = params.referrer;
       loadParams.transition_type = params.transition;
       loadParams.is_renderer_initiated = params.is_renderer_initiated;
       webState->GetNavigationManager()->LoadURLWithParams(loadParams);
       return webState;
     }
+    case WindowOpenDisposition::NEW_POPUP: {
+      Tab* tab = [[self tabModel]
+          insertOrUpdateTabWithURL:params.url
+                          referrer:params.referrer
+                        transition:params.transition
+                        windowName:nil
+                            opener:LegacyTabHelper::GetTabForWebState(webState)
+                       openedByDOM:YES
+                           atIndex:TabModelConstants::kTabPositionAutomatically
+                      inBackground:NO];
+      return tab.webState;
+    }
     default:
       NOTIMPLEMENTED();
       return nullptr;
   };
 }
 
 - (BOOL)webState:(web::WebState*)webState
     handleContextMenu:(const web::ContextMenuParams&)params {
   // Prevent context menu from displaying for a tab which is no longer the
   // current one.
@@ skipping 2624 matching lines @@
 
 - (UIView*)voiceSearchButton {
   return _voiceSearchButton;
 }
 
 - (id<LogoAnimationControllerOwner>)logoAnimationControllerOwner {
   return [self currentLogoAnimationControllerOwner];
 }
 
 @end