BrowserView::SetBounds UAF (macOS)

Target: macOS ASAN build of Chromium.
Bug: BrowserView::SetBounds dereferences this after ExitFullscreen() reaches the -[NSWindow toggleFullScreen:] nested run loop, where a queued close can synchronously destroy the BrowserView via HandleDeferredClose().

  1. Click the button below to open a script-controlled popup (!is_type_normal() Browser).
  2. In the popup, click the macOS native green fullscreen button (or press ⌃⌘F). This puts the popup in browser fullscreen (FullscreenMode::kWindowed), which is not dropped by ForSecurityDropFullscreen.
  3. Once fullscreen, click anywhere inside the popup (or wait for the auto-trigger). The popup sends SetWindowRect followed by window.close().