Fixes crash in SaveWindowPlacement. It's possible to get a WM_CLOSE

after a WM_DESTROY. The current code in WM_DESTROY removes the
properties, which means if we get a WM_CLOSE after WM_DESTROY we can't
locate the profile and end up using local_state prefs, which haven't
had the pref registered and we crash. The fix is to remove the
properties in OnFinalMessage.

BUG=91396
TEST=none
R=ben@chromium.org

Review URL: http://codereview.chromium.org/7741044

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@98633 0039d316-1c4b-4281-b951-d872f2087c98

views/widget/native_widget_win.cc

@@ -1272,8 +1272,6 @@ void NativeWidgetWin::OnDestroy() {
     RevokeDragDrop(hwnd());
     drop_target_ = NULL;
   }
-
-  props_.reset();
 }
 
 void NativeWidgetWin::OnDisplayChange(UINT bits_per_pixel, CSize screen_size) {
@@ -2052,6 +2050,9 @@ void NativeWidgetWin::OnWindowPosChanged(WINDOWPOS* window_pos) {
 }
 
 void NativeWidgetWin::OnFinalMessage(HWND window) {
+  // We don't destroy props in WM_DESTROY as we may still get messages after
+  // WM_DESTROY that assume the properties are still valid (such as WM_CLOSE).
+  props_.reset();
   delegate_->OnNativeWidgetDestroyed();
   if (ownership_ == Widget::InitParams::NATIVE_WIDGET_OWNS_WIDGET)
     delete this;