This was discovered while attempting to move tests from PlatformWindowMus to NativeWidgetMus (see build failure on https://codereview.chromium.org/1982663003/#ps1).

WindowTreeClientImpl::capture_window_ may be freed before WindowTreeClientImpl triggers observers on capture_window_. Naturally, triggering observers on the freed window can cause a crash.

This must be fixed by:

(1) Changing ownership model for windows that may become a WindowTreeClientImpl::capture_window_,
or
(2) Notifying WindowTreeClientImpl that its capture_window_ is being destroyed via an observer, callback, or similar.