browser: reset delegate in OnTabClosing()

When OnTabClosing() is called the WebContents has been removed from the
model. This is problematic as it's entirely likely for some of the code
in OnTabClosing() to trigger a call back to Browser by way of a delegate
which then expects the WebContents to be in the model. The fix is to reset
the delegate early on in the future, so that none of the code calls back to
Browser.

TabDetachedAtImpl() also resets the delegate, but TabDetachedAtImpl() may
be called in scenarios where OnTabClosing() is not called.

BUG=1007379
TEST=none

Change-Id: I6d0141a540b39ce52725d7bc198175e1b89a40af
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1825924Reviewed-by: Dana Fried <dfried@chromium.org>
Commit-Queue: Scott Violet <sky@chromium.org>
Cr-Commit-Position: refs/heads/master@{#700416}

chrome/browser/ui/browser.cc

@@ -2098,6 +2098,13 @@ void Browser::OnTabInsertedAt(WebContents* contents, int index) {
 }
 
 void Browser::OnTabClosing(WebContents* contents) {
+  // When this function is called |contents| has been removed from the
+  // TabStripModel. Some of the following code may trigger calling to the
+  // WebContentsDelegate, which is |this|, which may try to look for the
+  // WebContents in the TabStripModel, and fail because the WebContents has
+  // been removed. To avoid these problems the delegate is reset now.
+  SetAsDelegate(contents, false);
+
   // Typically, ModalDialogs are closed when the WebContents is destroyed.
   // However, when the tab is being closed, we must first close the dialogs [to
   // give them an opportunity to clean up after themselves] while the state