Fixes possible crash if the window hosting a menu was closed while the

views/controls/menu/submenu_view.h

-// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
+// Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef VIEWS_CONTROLS_MENU_SUBMENU_VIEW_H_
 #define VIEWS_CONTROLS_MENU_SUBMENU_VIEW_H_
 
 #include "views/controls/menu/menu_delegate.h"
 #include "views/view.h"
 
 namespace views {
@@ skipping 99 matching lines @@
   // The selection is NOT shown during drag and drop when the drop is over
   // the menu.
   bool GetShowSelection(MenuItemView* item);
 
   // Returns the container for the SubmenuView.
   MenuScrollViewContainer* GetScrollViewContainer();
 
   // Returns the NativeWindow host of the menu, or NULL if not showing.
   gfx::NativeWindow native_window() const;
 
+  // Invoked if the menu is prematurely destroyed. This can happen if the window
+  // closes while the menu is shown. If invoked the SubmenuView must drop all
+  // references to the MenuHost as the MenuHost is about to be deleted.
+  void MenuHostDestroyed();
+
   // Padding around the edges of the submenu.
   static const int kSubmenuBorderSize;
 
  private:
   // Paints the drop indicator. This is only invoked if item is non-NULL and
   // position is not DROP_NONE.
   void PaintDropIndicator(gfx::Canvas* canvas,
                           MenuItemView* item,
                           MenuDelegate::DropPosition position);
 
   void SchedulePaintForDropIndicator(MenuItemView* item,
                                      MenuDelegate::DropPosition position);
 
   // Calculates the location of th edrop indicator.
   gfx::Rect CalculateDropIndicatorBounds(MenuItemView* item,
                                          MenuDelegate::DropPosition position);
 
   // Parent menu item.
   MenuItemView* parent_menu_item_;
 
-  // Widget subclass used to show the children.
+  // Widget subclass used to show the children. This is deleted when we invoke
+  // |DestroyMenuHost|, or |MenuHostDestroyed| is invoked back on us.
   MenuHost* host_;
 
   // If non-null, indicates a drop is in progress and drop_item is the item
   // the drop is over.
   MenuItemView* drop_item_;
 
   // Position of the drop.
   MenuDelegate::DropPosition drop_position_;
 
   // Ancestor of the SubmenuView, lazily created.
   MenuScrollViewContainer* scroll_view_container_;
 
   DISALLOW_COPY_AND_ASSIGN(SubmenuView);
 };
 
 }  // namespace views
 
 #endif  // VIEWS_CONTROLS_MENU_SUBMENU_VIEW_H_