Fixes possible crash if the window hosting a menu was closed while the

views/controls/button/menu_button.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "views/controls/button/menu_button.h"
 
 #include "app/drag_drop_types.h"
 #include "app/l10n_util.h"
 #include "app/resource_bundle.h"
 #include "gfx/canvas.h"
@@ skipping 31 matching lines @@
 
 MenuButton::MenuButton(ButtonListener* listener,
                        const std::wstring& text,
                        ViewMenuDelegate* menu_delegate,
                        bool show_menu_marker)
     : TextButton(listener, text),
       menu_visible_(false),
       menu_delegate_(menu_delegate),
       show_menu_marker_(show_menu_marker),
       menu_marker_(ResourceBundle::GetSharedInstance().GetBitmapNamed(
-          IDR_MENU_DROPARROW)) {
+                       IDR_MENU_DROPARROW)),
+      destroyed_flag_(NULL) {
   set_alignment(TextButton::ALIGN_LEFT);
 }
 
 MenuButton::~MenuButton() {
+  if (destroyed_flag_)
+    *destroyed_flag_ = true;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 //
 // MenuButton - Public APIs
 //
 ////////////////////////////////////////////////////////////////////////////////
 
 gfx::Size MenuButton::GetPreferredSize() {
   gfx::Size prefsize = TextButton::GetPreferredSize();
@@ skipping 71 matching lines @@
     // We're about to show the menu from a mouse press. By showing from the
     // mouse press event we block RootView in mouse dispatching. This also
     // appears to cause RootView to get a mouse pressed BEFORE the mouse
     // release is seen, which means RootView sends us another mouse press no
     // matter where the user pressed. To force RootView to recalculate the
     // mouse target during the mouse press we explicitly set the mouse handler
     // to NULL.
     GetRootView()->SetMouseHandler(NULL);
 
     menu_visible_ = true;
+
+    bool destroyed = false;
+    destroyed_flag_ = &destroyed;
+
     menu_delegate_->RunMenu(this, menu_position);
+
+    if (destroyed) {
+      // The menu was deleted while showing. Don't attempt any processing.
+      return false;
+    }
+
     menu_visible_ = false;
     menu_closed_time_ = Time::Now();
 
     // Now that the menu has closed, we need to manually reset state to
     // "normal" since the menu modal loop will have prevented normal
     // mouse move messages from getting to this View. We set "normal"
     // and not "hot" because the likelihood is that the mouse is now
     // somewhere else (user clicked elsewhere on screen to close the menu
     // or selected an item) and we will inevitably refresh the hot state
     // in the event the mouse _is_ over the view.
@@ skipping 88 matching lines @@
 
   *state = AccessibilityTypes::STATE_HASPOPUP;
   return true;
 }
 
 std::string MenuButton::GetClassName() const {
   return kViewClassName;
 }
 
 }  // namespace views