Fixes possible crash if the window hosting a menu was closed while the

views/controls/menu/menu_controller.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "views/controls/menu/menu_controller.h"
 
 #include "app/l10n_util.h"
 #include "app/os_exchange_data.h"
 #include "base/i18n/rtl.h"
 #include "base/keyboard_codes.h"
 #include "base/time.h"
 #include "gfx/canvas.h"
 #include "views/controls/button/menu_button.h"
 #include "views/controls/menu/menu_scroll_view_container.h"
 #include "views/controls/menu/submenu_view.h"
 #include "views/drag_utils.h"
 #include "views/screen.h"
 #include "views/view_constants.h"
+#include "views/views_delegate.h"
 #include "views/widget/root_view.h"
 #include "views/widget/widget.h"
+
 #if defined(OS_LINUX)
 #include "base/keyboard_code_conversion_gtk.h"
 #endif
 
 using base::Time;
 using base::TimeDelta;
 
 // Period of the scroll timer (in milliseconds).
 static const int kScrollTimerMS = 30;
 
@@ skipping 153 matching lines @@
     return NULL;
   } else if (button) {
     menu_button_ = button;
   }
 
 #ifdef DEBUG_MENU
   nested_depth++;
   DLOG(INFO) << " entering nested loop, depth=" << nested_depth;
 #endif
 
+  // Make sure Chrome doesn't attempt to shut down while the menu is showing.
+  if (ViewsDelegate::views_delegate)
+    ViewsDelegate::views_delegate->AddRef();
+
   MessageLoopForUI* loop = MessageLoopForUI::current();
   if (MenuItemView::allow_task_nesting_during_run_) {
     bool did_allow_task_nesting = loop->NestableTasksAllowed();
     loop->SetNestableTasksAllowed(true);
     loop->Run(this);
     loop->SetNestableTasksAllowed(did_allow_task_nesting);
   } else {
     loop->Run(this);
   }
 
+  if (ViewsDelegate::views_delegate)
+    ViewsDelegate::views_delegate->ReleaseRef();
+
 #ifdef DEBUG_MENU
   nested_depth--;
   DLOG(INFO) << " exiting nested loop,  depth=" << nested_depth;
 #endif
 
   // Close any open menus.
   SetSelection(NULL, false, true);
 
   if (nested_menu) {
     DCHECK(!menu_stack_.empty());
@@ skipping 17 matching lines @@
   if (exit_type_ == EXIT_OUTERMOST) {
     exit_type_ = EXIT_NONE;
   } else {
     if (nested_menu && result) {
       // We're nested and about to return a value. The caller might enter
       // another blocking loop. We need to make sure all menus are hidden
       // before that happens otherwise the menus will stay on screen.
       CloseAllNestedMenus();
 
       // Set exit_all_, which makes sure all nested loops exit immediately.
-      exit_type_ = EXIT_ALL;
+      if (exit_type_ != EXIT_DESTROYED)
+        exit_type_ = EXIT_ALL;
     }
   }
 
-  if (menu_button_) {
+  // If we stopped running because one of the menus was destroyed chances are
+  // the button was also destroyed.
+  if (exit_type_ != EXIT_DESTROYED && menu_button_) {
     menu_button_->SetState(CustomButton::BS_NORMAL);
     menu_button_->SchedulePaint();
   }
 
   return result;
 }
 
 void MenuController::SetSelection(MenuItemView* menu_item,
                                   bool open_submenu,
                                   bool update_immediately) {
@@ skipping 23 matching lines @@
   // Stop timers.
   StopShowTimer();
   StopCancelAllTimer();
 
   if (update_immediately)
     CommitPendingSelection();
   else
     StartShowTimer();
 }
 
-void MenuController::Cancel(bool all) {
+void MenuController::Cancel(ExitType type) {
   if (!showing_) {
     // This occurs if we're in the process of notifying the delegate for a drop
     // and the delegate cancels us.
     return;
   }
 
   MenuItemView* selected = state_.item;
-  exit_type_ = all ? EXIT_ALL : EXIT_OUTERMOST;
+  exit_type_ = type;
 
   // Hide windows immediately.
   SetSelection(NULL, false, true);
 
   if (!blocking_run_) {
     // If we didn't block the caller we need to notify the menu, which
     // triggers deleting us.
     DCHECK(selected);
     showing_ = false;
     selected->GetRootMenuItem()->DropMenuClosed(true);
@@ skipping 21 matching lines @@
 
     // We're going to close and we own the mouse capture. We need to repost the
     // mouse down, otherwise the window the user clicked on won't get the
     // event.
 #if defined(OS_WIN)
     RepostEvent(source, event);
     // NOTE: not reposting on linux seems fine.
 #endif
 
     // And close.
-    Cancel(true);
+    Cancel(EXIT_ALL);
     return;
   }
 
   bool open_submenu = false;
   if (!part.menu) {
     part.menu = part.parent;
     open_submenu = true;
   } else {
     if (part.menu->GetDelegate()->CanDrag(part.menu)) {
       possible_drag_ = true;
@@ skipping 37 matching lines @@
       drag_utils::SetDragImageOnDataObject(canvas, item->size(), press_loc,
                                            &data);
       StopScrolling();
       int drag_ops = item->GetDelegate()->GetDragOperations(item);
       item->GetRootView()->StartDragForViewFromMouseEvent(
           NULL, data, drag_ops);
       if (GetActiveInstance() == this) {
         if (showing_) {
           // We're still showing, close all menus.
           CloseAllNestedMenus();
-          Cancel(true);
+          Cancel(EXIT_ALL);
         }  // else case, drop was on us.
       }  // else case, someone canceled us, don't do anything
     }
     return;
   }
   if (part.type == MenuPart::MENU_ITEM) {
     if (!part.menu)
       part.menu = source->GetMenuItem();
     SetSelection(part.menu ? part.menu : state_.item, true, false);
   } else if (part.type == MenuPart::NONE) {
@@ skipping 222 matching lines @@
 
 // static
 void MenuController::SetActiveInstance(MenuController* controller) {
   active_instance_ = controller;
 }
 
 #if defined(OS_WIN)
 bool MenuController::Dispatch(const MSG& msg) {
   DCHECK(blocking_run_);
 
-  if (exit_type_ == EXIT_ALL) {
+  if (exit_type_ == EXIT_ALL || exit_type_ == EXIT_DESTROYED) {
     // We must translate/dispatch the message here, otherwise we would drop
     // the message on the floor.
     TranslateMessage(&msg);
     DispatchMessage(&msg);
     return false;
   }
 
   // NOTE: we don't get WM_ACTIVATE or anything else interesting in here.
   switch (msg.message) {
     case WM_CONTEXTMENU: {
@@ skipping 20 matching lines @@
 
     case WM_SYSKEYUP:
       // We may have been shown on a system key, as such don't do anything
       // here. If another system key is pushed we'll get a WM_SYSKEYDOWN and
       // close the menu.
       return true;
 
     case WM_CANCELMODE:
     case WM_SYSKEYDOWN:
       // Exit immediately on system keys.
-      Cancel(true);
+      Cancel(EXIT_ALL);
       return false;
 
     default:
       break;
   }
   TranslateMessage(&msg);
   DispatchMessage(&msg);
   return exit_type_ == EXIT_NONE;
 }
 
 #else
 bool MenuController::Dispatch(GdkEvent* event) {
   gtk_main_do_event(event);
 
-  if (exit_type_ == EXIT_ALL)
+  if (exit_type_ == EXIT_ALL || exit_type_ == EXIT_DESTROYED)
     return false;
 
   switch (event->type) {
     case GDK_KEY_PRESS: {
       base::KeyboardCode win_keycode =
           base::WindowsKeyCodeForGdkKeyCode(event->key.keyval);
       if (!OnKeyDown(win_keycode))
         return false;
       guint32 keycode = gdk_keyval_to_unicode(event->key.keyval);
       if (keycode)
@@ skipping 52 matching lines @@
         }
       }
       break;
 
     case base::VKEY_ESCAPE:
       if (!state_.item->GetParentMenuItem() ||
           (!state_.item->GetParentMenuItem()->GetParentMenuItem() &&
            (!state_.item->HasSubmenu() ||
             !state_.item->GetSubmenu()->IsShowing()))) {
         // User pressed escape and only one menu is shown, cancel it.
-        Cancel(false);
+        Cancel(EXIT_OUTERMOST);
         return false;
       } else {
         CloseSubmenu();
       }
       break;
 
 #if defined(OS_WIN)
     case VK_APPS:
       break;
 #endif
@@ skipping 721 matching lines @@
   if (!scroll_task_.get())
     scroll_task_.reset(new MenuScrollTask());
   scroll_task_->Update(part);
 }
 
 void MenuController::StopScrolling() {
   scroll_task_.reset(NULL);
 }
 
 }  // namespace views