BraveActionsContainer::SetPopupOwner crash when disabling shield on certain websites

[kjozwiak]

Description

Ran into the following crash when I disabled Brave Shields while on https://www.motorsport.com. I can't seem to reproduce it consistently but I've seen this happen a few times on https://www.motorsport.com.

• b9de0700-73d0-5d07-0000-000000000000

https://brave.sp.backtrace.io/p/brave/triage?filters=(_rxid%3Db9de0700-73d0-5d07-0000-000000000000)&aggregations=((fingerprint%3Bissues%3Binvariants%2Chead)%2C(fingerprint%3Bissues%3Btags%2Chead)%2C(fingerprint%3Bissues%3Bticket%2Chead)%2C(fingerprint%3Bissues%3Bassignee%2Chead)%2C(fingerprint%3Bissues%3Bstate%2Chead)%2C(fingerprint%3Bfirst_seen%2Chead)%2C(callstack%2Chead)%2C(timestamp%2Cbin%2C32)%2C(timestamp%2Crange)%2C(uname.sysname%2Cdistribution%2C3)%2C(ver%2Cmax)%2C(ver%2Cmin)%2C(guid%2Cunique)%2C(classifiers%2Chead))&similarity=false

[ 00 ] BraveActionsContainer::SetPopupOwner(ToolbarActionViewController *)
[ 01 ] _tailMerge_esent.dll
[ 02 ] void base::internal::ThreadCache::FreeAfter(class base::internal::PartitionFreelistEntry *, unsigned __int64)
[ 03 ] cc::SingleThreadProxy::ScheduledActionSendBeginMainFrame(viz::BeginFrameArgs const &)
[ 04 ] BraveActionViewController::OnPopupClosed()
[ 05 ] extensions::ExtensionHost::~ExtensionHost()
[ 06 ] _tailMerge_esent.dll
[ 07 ] base::internal::CheckedObserverAdapter::IsMarkedForRemoval()
[ 08 ] void ExtensionPopup::~ExtensionPopup()
[ 09 ] void ExtensionPopup::~ExtensionPopup()
[ 10 ] base::internal::CheckedObserverAdapter::IsMarkedForRemoval()
[ 11 ] views::WidgetDelegate::DeleteDelegate()
[ 12 ] void base::ObserverList<AccessContextAuditService::CookieAccessHelper,0,1,base::internal::CheckedObserverAdapter>::Iter::~Iter()
[ 13 ] void base::RefCounted<ui::ViewProp::Data,base::DefaultRefCountedTraits<ui::ViewProp::Data> >::Release()
[ 14 ] views::Widget::OnNativeWidgetDestroyed()
[ 15 ] views::DesktopNativeWidgetAura::OnHostClosed()
[ 16 ] views::HWNDMessageHandler::OnWndProc(unsigned int,unsigned __int64,__int64)
[ 17 ] 0x7fff54bc23e6
[ 18 ] gfx::CrashIdHelper::OnWillProcessMessages(std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char> > const &)
[ 19 ] 0x7fff54bca95a
[ 20 ] gfx::GetWindowUserData(HWND__ *)
....

Steps to Reproduce

1. visit https://motorsport.com
2. disable the shields (sometimes you'll get an instant crash)

Actual result:

Brave completely crashes as per the above.

Expected result:

Brave shouldn't be crashing when a user disables the shields

Reproduces how often:

It's pretty hard to reproduce. I've only seen this happen a few times before. I would say maybe ~5% chance to reproduce.

Brave version (brave://version info)

Brave | 1.35.8 Chromium: 96.0.4664.55 (Official Build) nightly (64-bit)
-- | --
Revision | 38cededc5d09b785d12203f1d3209aa6eb293e79-refs/branch-heads/4664@{#1090}
OS | Windows 11 Version 21H2 (Build 22000.348)

Version/Channel Information:

• Can you reproduce this issue with the current release? I'm not 100% sure due to the crash being difficult to reproduce
• Can you reproduce this issue with the beta channel? I'm not 100% sure due to the crash being difficult to reproduce
• Can you reproduce this issue with the nightly channel? Yes

Other Additional Information:

• Does the issue resolve itself when disabling Brave Shields? No (it actually causes the crash as mentioned above)
• Does the issue resolve itself when disabling Brave Rewards? N/A
• Is the issue reproducible on the latest version of Chrome? N/A

Miscellaneous Information:

[btlechowski]

Verification passed on

Brave	1.34.71 Chromium: 97.0.4692.56 (Official Build) beta (64-bit)
Revision	04da6c66398ca50e603cc236a07dc7dfd3bbc750-refs/branch-heads/4692@{#990}
OS	Ubuntu 18.04 LTS

Verified test plan from the description
Verified no crash

---

Verification passed on

Brave | 1.34.73 Chromium: 97.0.4692.56 (Official Build) beta (64-bit)
-- | --
Revision | 04da6c66398ca50e603cc236a07dc7dfd3bbc750-refs/branch-heads/4692@{#990}
OS | Windows 10 Version 21H2 (Build 19044.1415)

Verified test plan from the description
Verified no crash

---

Verified PASSED on

Brave	1.34.74 Chromium: 97.0.4692.56 (Official Build) beta (x86_64)
Revision	04da6c66398ca50e603cc236a07dc7dfd3bbc750-refs/branch-heads/4692@{#990}
OS	macOS Version 11.6.1 (Build 20G224)

Verified test plan from the description; no crash