GitLab

TabSearchButton is-a WidgetObserver and uses a ScopedObserver to
observe its associated bubble Widget.

Currently TabSearchButton removes itself as an observer of the
Widget in the OnWidgetClosed() WidgetObserver method.

However this is not called when the operating system deletes the
window and the ScopedObserver causes a heap use-after-free error
when it goes out of scope.

This CL fixes the issue by removing itself as an observer of the
Widet in the OnWidgetDestroying() method which is always called
when the widget is deleted.

See:
https://source.chromium.org/chromium/chromium/src/+/master:ui/aura/window.cc;l=130;drc=f7600fd0b168f7c7ebefbb27a91cbefb0d090c0c

Similar usage of a ScopedObserver observing Widgets:
https://source.chromium.org/chromium/chromium/src/+/master:chrome/browser/ui/views/frame/browser_view.cc;l=2572;drc=f7600fd0b168f7c7ebefbb27a91cbefb0d090c0c

Bug: 1143448
Change-Id: I7e88d5cb64800e6fb2a7c88b2233fc628e7d6d80
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2506561Reviewed-by: Scott Violet <sky@chromium.org>
Commit-Queue: Thomas Lukaszewicz <tluk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#822206}