Fix crash under ExclusiveAccessBubbleViews::AnimationProgressed().

chrome/browser/ui/views/exclusive_access_bubble_views.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/views/exclusive_access_bubble_views.h"
 
 #include <utility>
 
 #include "base/i18n/case_conversion.h"
 #include "base/location.h"
@@ skipping 264 matching lines @@
 }
 
 void ExclusiveAccessBubbleViews::Observe(
     int type,
     const content::NotificationSource& source,
     const content::NotificationDetails& details) {
   DCHECK_EQ(chrome::NOTIFICATION_FULLSCREEN_CHANGED, type);
   UpdateMouseWatcher();
 }
 
+void ExclusiveAccessBubbleViews::OnWidgetDestroyed(views::Widget* widget) {
+  // Although SubtleNotificationView uses WIDGET_OWNS_NATIVE_WIDGET, a close can

[msw, 2017/05/03 18:48:33]

Would using the default NATIVE_WIDGET_OWNS_WIDGET codepath simplify things at
this point? (I'm not sure, just asking)

[tapted, 2017/05/04 06:42:07]

I think this added complexity would remain. That is, we'd still need both
codepaths. The difference would be that the destructor calls popup_->Close()
rather than `delete popup_;` (and.. I think that's all). But there's also a
comment in ~ExclusiveAccessBubbleViews(): "We also can't set the popup's
ownership model to NATIVE_WIDGET_OWNS_WIDGET because if the user closed the last
tab while in fullscreen mode, Windows has already destroyed the popup HWND"

Although I suspect now that by watching OnWidgetDestroyed() we cater for that
"gotcha" where the popup HWND has already been closed as well. That is, the
workaround to avoid NATIVE_WIDGET_OWNS_WIDGET works but only so long as an
animation timer didn't get into the run queue before |this| got destroyed.

+  // originate from the OS or some Chrome shutdown codepaths that bypass the
+  // destructor.
+  views::Widget* popup_on_stack = popup_;
+  DCHECK(popup_on_stack->HasObserver(this));
+
+  // Get ourselves destroyed. Calling ExitExclusiveAccess() won't work because
+  // the parent window might be destroyed as well, so asking it to exit
+  // fullscreen would be a bad idea.
+  bubble_view_context_->DestroyAnyExclusiveAccessBubble();
+
+  // Note: |this| is destroyed on the line above. Check that the destructor was
+  // invoked. Note this is safe to do since |popup_| is deleted via a posted

[msw, 2017/05/03 18:48:33]

optional nit: remove "Note" to avoid an extra line wrap :)

[tapted, 2017/05/04 06:42:07]

Done.

+  // task.
+  DCHECK(!popup_on_stack->HasObserver(this));
+}
+
 void ExclusiveAccessBubbleViews::OnWidgetVisibilityChanged(
     views::Widget* widget,
     bool visible) {
   UpdateMouseWatcher();
 }
 
 void ExclusiveAccessBubbleViews::LinkClicked(views::Link* link,
                                              int event_flags) {
   ExitExclusiveAccess();
 }