Fix a crash canceling a completed, auto-opened download

chrome/browser/views/download_item_view.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/views/download_item_view.h"
 
 #include <vector>
 
 #include "app/gfx/canvas.h"
 #include "app/gfx/text_elider.h"
@@ skipping 54 matching lines @@
 
 // How long we keep the item disabled after the user clicked it to open the
 // downloaded item.
 static const int kDisabledOnOpenDuration = 3000;
 
 // DownloadShelfContextMenuWin -------------------------------------------------
 
 class DownloadShelfContextMenuWin : public DownloadShelfContextMenu,
                                     public views::Menu::Delegate {
  public:
-  DownloadShelfContextMenuWin(BaseDownloadItemModel* model,
-                              gfx::NativeView window,
-                              const gfx::Point& point)
+  DownloadShelfContextMenuWin(BaseDownloadItemModel* model)
       : DownloadShelfContextMenu(model) {
     DCHECK(model);
+  }
 
+  void Run(gfx::NativeView window, const gfx::Point& point) {
     // The menu's anchor point is determined based on the UI layout.
     views::Menu::AnchorPoint anchor_point;
     if (l10n_util::GetTextDirection() == l10n_util::RIGHT_TO_LEFT)
       anchor_point = views::Menu::TOPRIGHT;
     else
       anchor_point = views::Menu::TOPLEFT;
 
     scoped_ptr<views::Menu> context_menu(
         views::Menu::Create(this, anchor_point, window));
     if (download_->state() == DownloadItem::COMPLETE) {
       context_menu->AppendMenuItem(OPEN_WHEN_COMPLETE, L"",
                                    views::Menu::NORMAL);
     } else {
       context_menu->AppendMenuItem(OPEN_WHEN_COMPLETE, L"",
                                    views::Menu::CHECKBOX);
     }
     context_menu->AppendMenuItem(ALWAYS_OPEN_TYPE, L"", views::Menu::CHECKBOX);
     context_menu->AppendSeparator();
     if (download_->state() == DownloadItem::IN_PROGRESS)
       context_menu->AppendMenuItem(TOGGLE_PAUSE, L"", views::Menu::NORMAL);
     context_menu->AppendMenuItem(SHOW_IN_FOLDER, L"", views::Menu::NORMAL);
     context_menu->AppendSeparator();
     context_menu->AppendMenuItem(REMOVE_ITEM, L"", views::Menu::NORMAL);
     context_menu->AppendMenuItem(CANCEL, L"", views::Menu::NORMAL);
     context_menu->RunMenuAt(point.x(), point.y());
   }
 
+  // This method runs when the caller has been deleted and we should not attempt
+  // to access |download_|.
+  void Stop() {
+    download_ = NULL;
+    model_ = NULL;
+  }
+
   // Menu::Delegate implementation ---------------------------------------------
 
   virtual bool IsItemChecked(int id) const {
+    if (!download_)
+      return false;
     return ItemIsChecked(id);
   }
 
   virtual bool IsItemDefault(int id) const {
+    if (!download_)
+      return false;
     return ItemIsDefault(id);
   }
 
   virtual std::wstring GetLabel(int id) const {
+    if (!download_)
+      return std::wstring();
     return GetItemLabel(id);
   }
 
   virtual bool SupportsCommand(int id) const {
+    if (!download_)
+      return false;
     return id > 0 && id < MENU_LAST;
   }
 
   virtual bool IsCommandEnabled(int id) const {
+    if (!download_)
+      return false;
     return IsItemCommandEnabled(id);
   }
 
   virtual void ExecuteCommand(int id) {
-    return ExecuteItemCommand(id);
+    if (download_)
+      ExecuteItemCommand(id);
   }
 };
 
 // DownloadItemView ------------------------------------------------------------
 
 DownloadItemView::DownloadItemView(DownloadItem* download,
     DownloadShelfView* parent,
     BaseDownloadItemModel* model)
   : warning_icon_(NULL),
     download_(download),
     parent_(parent),
     status_text_(l10n_util::GetString(IDS_DOWNLOAD_STATUS_STARTING)),
     show_status_text_(true),
     body_state_(NORMAL),
     drop_down_state_(NORMAL),
     progress_angle_(download_util::kStartAngleDegrees),
     drop_down_pressed_(false),
     dragging_(false),
     starting_drag_(false),
     model_(model),
     save_button_(NULL),
     discard_button_(NULL),
     dangerous_download_label_(NULL),
     dangerous_download_label_sized_(false),
     disabled_while_opening_(false),
     creation_time_(base::Time::Now()),
-    ALLOW_THIS_IN_INITIALIZER_LIST(reenable_method_factory_(this)) {
+    ALLOW_THIS_IN_INITIALIZER_LIST(reenable_method_factory_(this)),
+    active_menu_(NULL) {
   DCHECK(download_);
   download_->AddObserver(this);
 
   ResourceBundle &rb = ResourceBundle::GetSharedInstance();
 
   BodyImageSet normal_body_image_set = {
     rb.GetBitmapNamed(IDR_DOWNLOAD_BUTTON_LEFT_TOP),
     rb.GetBitmapNamed(IDR_DOWNLOAD_BUTTON_LEFT_MIDDLE),
     rb.GetBitmapNamed(IDR_DOWNLOAD_BUTTON_LEFT_BOTTOM),
     rb.GetBitmapNamed(IDR_DOWNLOAD_BUTTON_CENTER_TOP),
@@ skipping 144 matching lines @@
         views::Label::ALIGN_LEFT);
     AddChildView(dangerous_download_label_);
     SizeLabelToMinWidth();
   }
 
   // Set up our animation.
   StartDownloadProgress();
 }
 
 DownloadItemView::~DownloadItemView() {
+  if (active_menu_) {
+    active_menu_->Stop();
+    active_menu_ = NULL;
+  }
   icon_consumer_.CancelAllRequests();
   StopDownloadProgress();
   download_->RemoveObserver(this);
 }
 
 // Progress animation handlers.
 
 void DownloadItemView::UpdateDownloadProgress() {
   progress_angle_ = (progress_angle_ +
                      download_util::kUnknownIncrementDegrees) %
@@ skipping 477 matching lines @@
     // The menu's position is different depending on the UI layout.
     // DownloadShelfContextMenu will take care of setting the right anchor for
     // the menu depending on the locale.
     point.set_y(height());
     if (UILayoutIsRightToLeft())
       point.set_x(drop_down_x_right_);
     else
       point.set_x(drop_down_x_left_);
 
     views::View::ConvertPointToScreen(this, &point);
-    DownloadShelfContextMenuWin menu(model_.get(),
-                                     GetWidget()->GetNativeView(),
-                                     point);
+    DownloadShelfContextMenuWin menu(model_.get());
+
+    // Protect against deletion while the menu is running. This can happen if
+    // the menu is showing when an auto-opened download completes and the user
+    // chooses a menu entry.
+    active_menu_ = &menu;
+    menu.Run(GetWidget()->GetNativeView(), point);
+
     // If the menu action was to remove the download, this view will also be
     // invalid so we must not access 'this' in this case.
     if (menu.download()) {
+      active_menu_ = NULL;
       drop_down_pressed_ = false;
       // Showing the menu blocks. Here we revert the state.
       SetState(NORMAL, NORMAL);
     }
   }
   return true;
 }
 
 void DownloadItemView::OnMouseMoved(const views::MouseEvent& event) {
   // Mouse should not activate us in dangerous mode.
@@ skipping 158 matching lines @@
 void DownloadItemView::Reenable() {
   disabled_while_opening_ = false;
   SetEnabled(true);  // Triggers a repaint.
 }
 
 bool DownloadItemView::InDropDownButtonXCoordinateRange(int x) {
   if (x > drop_down_x_left_ && x < drop_down_x_right_)
     return true;
   return false;
 }