Prevent null-dereference in GetInitiallyFocusedView()

As BubbleDialogModelHost::Close() tear-down (removal of model_) is
synchronous, but views isn't. We need to check and see if the model_
has been destroyed when checking for the initially-focused view.

A TODO is left to see if we can prevent GetInitiallyFocusedView() from
being called after Widget::Close() has been called.

Bug: 1106422, 1130181
Change-Id: I8056c3dd242e9ec5ce8fc909a0f558dc7a264dae
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2425363Reviewed-by: Elly Fong-Jones <ellyjones@chromium.org>
Commit-Queue: Elly Fong-Jones <ellyjones@chromium.org>
Auto-Submit: Peter Boström <pbos@chromium.org>
Cr-Commit-Position: refs/heads/master@{#809764}

ui/views/bubble/bubble_dialog_model_host.cc

@@ -149,6 +149,12 @@ BubbleDialogModelHost::~BubbleDialogModelHost() {
 }
 
 View* BubbleDialogModelHost::GetInitiallyFocusedView() {
+  // TODO(pbos): Try to prevent uses of GetInitiallyFocusedView() after Close()
+  // and turn this in to a DCHECK for |model_| existence. This should fix
+  // https://crbug.com/1130181 for now.
+  if (!model_)
+    return BubbleDialogDelegateView::GetInitiallyFocusedView();
+
   base::Optional<int> unique_id = model_->initially_focused_field(GetPassKey());
 
   if (!unique_id)