Looks like another widget observer lifetime issue.

We should try to fix for 72.

Handing over to takumif@ as I will be out for some time starting tomorrow

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/f901ed6bd76d11e4484b456d24ea02c02c4b79a9

commit f901ed6bd76d11e4484b456d24ea02c02c4b79a9
Author: Takumi Fujimoto <takumif@chromium.org>
Date: Fri Dec 07 19:44:31 2018

Make sure to unregister MediaRouterDialogControllerViews as widget observer

Use-after-free was happening at shutdown due to
MediaRouterDialogControllerViews getting destroyed without unregistering
itself. We make MRDCV retain a pointer to the dialog widget to make sure
it unregisters itself, because GetCurrentDialogWidget() may become null
before the actual widget is destroyed. Also do all of the cleanup in
OnWidgetClosing() instead of splitting with OnWidgetDestroying().

Bug:  905498 
Change-Id: Idf9da7aaf33cd9db512681b688ebd95d0fae08ca
Reviewed-on: https://chromium-review.googlesource.com/c/1364295
Reviewed-by: Brandon Tolsch <btolsch@chromium.org>
Commit-Queue: Takumi Fujimoto <takumif@chromium.org>
Cr-Commit-Position: refs/heads/master@{#614787}
[modify] https://crrev.com/f901ed6bd76d11e4484b456d24ea02c02c4b79a9/chrome/browser/ui/views/media_router/media_router_dialog_controller_views.cc
[modify] https://crrev.com/f901ed6bd76d11e4484b456d24ea02c02c4b79a9/chrome/browser/ui/views/media_router/media_router_dialog_controller_views.h

Tried testing this issue on Mac OS 10.14.0 and 10.13.6 on the reported version 72.0.3608.4 and the latest M-73 73.0.3636.0 by following the below steps.

1. Launched Chrome 
2. Clicked on 3 dot menu >> Clicked on cast
3. Selected chrome and clicked on quit chrome and also clicked on command + Q 
4. Opened chrome://crashes  
As we have not seen any chrome crashes 

Attached is the screen cast for reference.

Takumi Fujimoto@ Request you to check and confirm if anything is missed from our end in verifying the issue and help us to verify the issue on the latest M-73 build.

Thanks...

Deleted: 905498.mp4 1.9 MB

	905498.mp4 1.9 MB View Download

phanindra.mandapaka@:
We need the flag #views-cast-dialog to be enabled to reproduce the bug, although that was not mentioned in the bug description.

I've verified on 73.0.3636.0 Canary on Mac that the fix is working. Requesting a merge into M72.

Your change meets the bar and is auto-approved for M72. Please go ahead and merge the CL to branch 3626 manually. Please contact milestone owner if you have questions.
Owners: govind@(Android), kariahda@(iOS), djmm@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/104d6be51923ff122592d9605f8010670b0eb67c

commit 104d6be51923ff122592d9605f8010670b0eb67c
Author: Takumi Fujimoto <takumif@chromium.org>
Date: Tue Dec 11 20:12:55 2018

Make sure to unregister MediaRouterDialogControllerViews as widget observer

Use-after-free was happening at shutdown due to
MediaRouterDialogControllerViews getting destroyed without unregistering
itself. We make MRDCV retain a pointer to the dialog widget to make sure
it unregisters itself, because GetCurrentDialogWidget() may become null
before the actual widget is destroyed. Also do all of the cleanup in
OnWidgetClosing() instead of splitting with OnWidgetDestroying().

TBR=takumif@chromium.org

(cherry picked from commit f901ed6bd76d11e4484b456d24ea02c02c4b79a9)

Bug:  905498 
Change-Id: Idf9da7aaf33cd9db512681b688ebd95d0fae08ca
Reviewed-on: https://chromium-review.googlesource.com/c/1364295
Reviewed-by: Brandon Tolsch <btolsch@chromium.org>
Commit-Queue: Takumi Fujimoto <takumif@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#614787}
Reviewed-on: https://chromium-review.googlesource.com/c/1372553
Reviewed-by: Takumi Fujimoto <takumif@chromium.org>
Cr-Commit-Position: refs/branch-heads/3626@{#260}
Cr-Branched-From: d897fb137fbaaa9355c0c93124cc048824eb1e65-refs/heads/master@{#612437}
[modify] https://crrev.com/104d6be51923ff122592d9605f8010670b0eb67c/chrome/browser/ui/views/media_router/media_router_dialog_controller_views.cc
[modify] https://crrev.com/104d6be51923ff122592d9605f8010670b0eb67c/chrome/browser/ui/views/media_router/media_router_dialog_controller_views.h

Able to reproduce the issue on Mac 10.14.0 using chrome build without fix 72.0.3608.4.

Verified the fix on Mac 10.14.0 using Chrome version #72.0.3626.17. Attaching screen shot for reference.
Observed that the chrome quits without crashing.
Hence, the issue is working as expected. 
Adding the verified labels.

Thanks..!

Deleted: 905498.mp4 3.8 MB

	905498.mp4 3.8 MB View Download

The following revision refers to this bug: 
https://chromium.googlesource.com/chromium/src.git/+/104d6be51923ff122592d9605f8010670b0eb67c

Commit: 104d6be51923ff122592d9605f8010670b0eb67c
Author: takumif@chromium.org
Commiter: takumif@chromium.org
Date: 2018-12-11 20:12:55 +0000 UTC

Make sure to unregister MediaRouterDialogControllerViews as widget observer

Use-after-free was happening at shutdown due to
MediaRouterDialogControllerViews getting destroyed without unregistering
itself. We make MRDCV retain a pointer to the dialog widget to make sure
it unregisters itself, because GetCurrentDialogWidget() may become null
before the actual widget is destroyed. Also do all of the cleanup in
OnWidgetClosing() instead of splitting with OnWidgetDestroying().

TBR=takumif@chromium.org

(cherry picked from commit f901ed6bd76d11e4484b456d24ea02c02c4b79a9)

Bug:  905498 
Change-Id: Idf9da7aaf33cd9db512681b688ebd95d0fae08ca
Reviewed-on: https://chromium-review.googlesource.com/c/1364295
Reviewed-by: Brandon Tolsch <btolsch@chromium.org>
Commit-Queue: Takumi Fujimoto <takumif@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#614787}
Reviewed-on: https://chromium-review.googlesource.com/c/1372553
Reviewed-by: Takumi Fujimoto <takumif@chromium.org>
Cr-Commit-Position: refs/branch-heads/3626@{#260}
Cr-Branched-From: d897fb137fbaaa9355c0c93124cc048824eb1e65-refs/heads/master@{#612437}