3 files changed, 38 insertions, 14 deletions

diff --git a/ash/wm/custom_frame_view_ash_unittest.cc b/ash/wm/custom_frame_view_ash_unittest.cc
index 9c2bd60..721c959 100644
--- a/ash/wm/custom_frame_view_ash_unittest.cc
+++ b/ash/wm/custom_frame_view_ash_unittest.cc
@@ -363,6 +363,29 @@ TEST_F(CustomFrameViewAshTest, MaximizeButtonExternalShutDown) {
   widget->CloseNow();
 }
 
+// Test that maximizing the browser after hovering in does not crash the system
+// when the observer gets removed in the bubble destruction process.
+TEST_F(CustomFrameViewAshTest, MaximizeOnHoverThenClick) {
+  views::Widget* widget = CreateWidget();
+  aura::Window* window = widget->GetNativeWindow();
+  CustomFrameViewAsh* frame = custom_frame_view_ash(widget);
+  CustomFrameViewAsh::TestApi test(frame);
+  ash::FrameMaximizeButton* maximize_button = test.maximize_button();
+  maximize_button->set_bubble_appearance_delay_ms(0);
+  gfx::Point button_pos = maximize_button->GetBoundsInScreen().CenterPoint();
+  gfx::Point off_pos(button_pos.x() + 100, button_pos.y() + 100);
+
+  aura::test::EventGenerator generator(window->GetRootWindow(), off_pos);
+  EXPECT_FALSE(maximize_button->maximizer());
+  EXPECT_TRUE(ash::wm::IsWindowNormal(window));
+
+  // Move the mouse cursor over the button to bring up the maximizer bubble.
+  generator.MoveMouseTo(button_pos);
+  EXPECT_TRUE(maximize_button->maximizer());
+  generator.ClickLeftButton();
+  EXPECT_TRUE(ash::wm::IsWindowMaximized(window));
+}
+
 // Test that hovering over a button in the balloon dialog will show the phantom
 // window. Moving then away from the button will hide it again. Then check that
 // pressing and dragging the button itself off the button will also release the
diff --git a/ash/wm/workspace/frame_maximize_button.cc b/ash/wm/workspace/frame_maximize_button.cc
index 33926c8..f47e470 100644
--- a/ash/wm/workspace/frame_maximize_button.cc
+++ b/ash/wm/workspace/frame_maximize_button.cc
@@ -83,7 +83,7 @@ FrameMaximizeButton::FrameMaximizeButton(views::ButtonListener* listener,
       frame_(frame),
       is_snap_enabled_(false),
       exceeded_drag_threshold_(false),
-      window_(NULL),
+      widget_(NULL),
       press_is_gesture_(false),
       snap_type_(SNAP_NONE),
       bubble_appearance_delay_ms_(kBubbleAppearanceDelayMS) {
@@ -95,8 +95,8 @@ FrameMaximizeButton::~FrameMaximizeButton() {
   // Before the window gets destroyed, the maximizer dialog needs to be shut
   // down since it would otherwise call into a deleted object.
   maximizer_.reset();
-  if (window_)
-    OnWindowDestroying(window_);
+  if (widget_)
+    OnWindowDestroying(widget_->GetNativeWindow());
 }
 
 void FrameMaximizeButton::SnapButtonHovered(SnapType type) {
@@ -170,11 +170,11 @@ void FrameMaximizeButton::OnWindowPropertyChanged(aura::Window* window,
 
 void FrameMaximizeButton::OnWindowDestroying(aura::Window* window) {
   maximizer_.reset();
-  if (window_) {
-    CHECK_EQ(window_, window);
-    window_->RemoveObserver(this);
-    window_ = NULL;
-    frame_->GetWidget()->RemoveObserver(this);
+  if (widget_) {
+    CHECK_EQ(widget_->GetNativeWindow(), window);
+    widget_->GetNativeWindow()->RemoveObserver(this);
+    widget_->RemoveObserver(this);
+    widget_ = NULL;
   }
 }
 
@@ -203,10 +203,10 @@ void FrameMaximizeButton::OnMouseEntered(const ui::MouseEvent& event) {
   ImageButton::OnMouseEntered(event);
   if (!maximizer_.get()) {
     DCHECK(GetWidget());
-    if (!window_) {
-      window_ = frame_->GetWidget()->GetNativeWindow();
-      window_->AddObserver(this);
-      frame_->GetWidget()->AddObserver(this);
+    if (!widget_) {
+      widget_ = frame_->GetWidget();
+      widget_->GetNativeWindow()->AddObserver(this);
+      widget_->AddObserver(this);
     }
     maximizer_.reset(new MaximizeBubbleController(
         this,
diff --git a/ash/wm/workspace/frame_maximize_button.h b/ash/wm/workspace/frame_maximize_button.h
index d1cf5c6..b6aa1fa 100644
--- a/ash/wm/workspace/frame_maximize_button.h
+++ b/ash/wm/workspace/frame_maximize_button.h
@@ -148,8 +148,9 @@ class ASH_EXPORT FrameMaximizeButton : public views::ImageButton,
   // Did the user drag far enough to trigger snapping?
   bool exceeded_drag_threshold_;
 
-  // This is the Window we are contained in.
-  aura::Window* window_;
+  // Remember the widget on which we have put some an observers,
+  // so that we can remove it upon destruction.
+  views::Widget* widget_;
 
   // Location of the press.
   gfx::Point press_location_;