Fix a bug where we access a view after deletion....

chrome/browser/views/download_item_view.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/views/download_item_view.h"
 
 #include <vector>
 
 #include "app/gfx/canvas.h"
 #include "app/gfx/text_elider.h"
@@ skipping 802 matching lines @@
     point.set_y(height());
     if (UILayoutIsRightToLeft())
       point.set_x(drop_down_x_right_);
     else
       point.set_x(drop_down_x_left_);
 
     views::View::ConvertPointToScreen(this, &point);
     DownloadShelfContextMenuWin menu(model_.get(),
                                      GetWidget()->GetNativeView(),
                                      point);
-    drop_down_pressed_ = false;
-    // Showing the menu blocks. Here we revert the state.
-    SetState(NORMAL, NORMAL);
+    // If the menu action was to remove the download, this view will also be
+    // invalid so we must not access 'this' in this case.
+    if (menu.download()) {
+      drop_down_pressed_ = false;
+      // Showing the menu blocks. Here we revert the state.
+      SetState(NORMAL, NORMAL);
+    }
   }
   return true;
 }
 
 void DownloadItemView::OnMouseMoved(const views::MouseEvent& event) {
   // Mouse should not activate us in dangerous mode.
   if (IsDangerousMode())
     return;
 
   bool on_body = !InDropDownButtonXCoordinateRange(event.x());
@@ skipping 154 matching lines @@
 void DownloadItemView::Reenable() {
   disabled_while_opening_ = false;
   SetEnabled(true);  // Triggers a repaint.
 }
 
 bool DownloadItemView::InDropDownButtonXCoordinateRange(int x) {
   if (x > drop_down_x_left_ && x < drop_down_x_right_)
     return true;
   return false;
 }