Force chooser bubbles to close synchronously.

chrome/browser/ui/views/website_settings/chooser_bubble_ui_view.cc

Index: chrome/browser/ui/views/website_settings/chooser_bubble_ui_view.cc
diff --git a/chrome/browser/ui/views/website_settings/chooser_bubble_ui_view.cc b/chrome/browser/ui/views/website_settings/chooser_bubble_ui_view.cc
index 9addbb159e720ef07e16f56a3dee5bbbcecc0fbe..38fa2e26b743a524558960f3aa97e89a2d7417a7 100644
--- a/chrome/browser/ui/views/website_settings/chooser_bubble_ui_view.cc
+++ b/chrome/browser/ui/views/website_settings/chooser_bubble_ui_view.cc
@@ -82,8 +82,7 @@ ChooserBubbleUiViewDelegate::ChooserBubbleUiViewDelegate(
     views::View* anchor_view,
     views::BubbleBorder::Arrow anchor_arrow,
     std::unique_ptr<ChooserController> chooser_controller)
-    : views::BubbleDialogDelegateView(anchor_view, anchor_arrow),
-      device_chooser_content_view_(nullptr) {
+    : views::BubbleDialogDelegateView(anchor_view, anchor_arrow) {
   // ------------------------------------
   // | Chooser bubble title             |
   // | -------------------------------- |
@@ -185,35 +184,46 @@ void ChooserBubbleUiViewDelegate::UpdateTableView() const {
 ChooserBubbleUiView::ChooserBubbleUiView(
     Browser* browser,
     std::unique_ptr<ChooserController> chooser_controller)
-    : browser_(browser), chooser_bubble_ui_view_delegate_(nullptr) {
+    : browser_(browser) {
   DCHECK(browser_);
   DCHECK(chooser_controller);
-  chooser_bubble_ui_view_delegate_ = new ChooserBubbleUiViewDelegate(
+  bubble_view_ = new ChooserBubbleUiViewDelegate(
       GetAnchorView(), GetAnchorArrow(), std::move(chooser_controller));
 }
 
 ChooserBubbleUiView::~ChooserBubbleUiView() {}
 
 void ChooserBubbleUiView::Show(BubbleReference bubble_reference) {
-  chooser_bubble_ui_view_delegate_->set_bubble_reference(bubble_reference);
+  bubble_view_->set_bubble_reference(bubble_reference);
 
   // Set |parent_window| because some valid anchors can become hidden.
   views::Widget* widget = views::Widget::GetWidgetForNativeWindow(
       browser_->window()->GetNativeWindow());
-  chooser_bubble_ui_view_delegate_->set_parent_window(widget->GetNativeView());
+  bubble_view_->set_parent_window(widget->GetNativeView());
 
-  views::BubbleDialogDelegateView::CreateBubble(
-      chooser_bubble_ui_view_delegate_)
-      ->Show();
-
-  chooser_bubble_ui_view_delegate_->UpdateTableView();
+  views::BubbleDialogDelegateView::CreateBubble(bubble_view_)->Show();
+  bubble_view_->GetWidget()->AddObserver(this);
+  bubble_view_->UpdateTableView();
 }
 
-void ChooserBubbleUiView::Close() {}
+void ChooserBubbleUiView::Close() {
+  if (bubble_view_ && !bubble_view_->GetWidget()->IsClosed()) {
+    // The widget hierarchy must be destroyed synchronously by using CloseNow
+    // because the ChooserController may hold a raw pointer to the
+    // RenderFrameHost. See https://crbug.com/697486 for an example.
+    bubble_view_->GetWidget()->CloseNow();
+  }
+}
 
 void ChooserBubbleUiView::UpdateAnchorPosition() {
-  chooser_bubble_ui_view_delegate_->UpdateAnchor(GetAnchorView(),
-                                                 GetAnchorArrow());
+  DCHECK(bubble_view_);
+  bubble_view_->UpdateAnchor(GetAnchorView(), GetAnchorArrow());
+}
+
+void ChooserBubbleUiView::OnWidgetClosing(views::Widget* widget) {
+  DCHECK_EQ(bubble_view_->GetWidget(), widget);
+  widget->RemoveObserver(this);
+  bubble_view_ = nullptr;
 }
 
 views::View* ChooserBubbleUiView::GetAnchorView() {