Fixes possible crash in menus on views/gtk. The crash would happen if...

views/controls/menu/native_menu_gtk.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved. Use of this
 // source code is governed by a BSD-style license that can be found in the
 // LICENSE file.
 
 #include "views/controls/menu/native_menu_gtk.h"
 
 #include <map>
 #include <string>
 
 #include "app/gfx/gtk_util.h"
@@ skipping 48 matching lines @@
 
 namespace views {
 
 ////////////////////////////////////////////////////////////////////////////////
 // NativeMenuGtk, public:
 
 NativeMenuGtk::NativeMenuGtk(menus::MenuModel* model)
     : model_(model),
       menu_(NULL),
       menu_shown_(false),
-      suppress_activate_signal_(false) {
+      suppress_activate_signal_(false),
+      menu_activated_(false),
+      activated_index_(-1) {
 }
 
 NativeMenuGtk::~NativeMenuGtk() {
   gtk_widget_destroy(menu_);
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // NativeMenuGtk, MenuWrapper implementation:
 
 void NativeMenuGtk::RunMenuAt(const gfx::Point& point, int alignment) {
+  menu_activated_ = false;
+
   UpdateStates();
   Position position = { point, static_cast<Menu2::Alignment>(alignment) };
   // TODO(beng): value of '1' will not work for context menus!
   gtk_menu_popup(GTK_MENU(menu_), NULL, NULL, MenuPositionFunc, &position, 1,
                  gtk_get_current_event_time());
 
   DCHECK(!menu_shown_);
   menu_shown_ = true;
   // Listen for "hide" signal so that we know when to return from the blocking
   // RunMenuAt call.
   gint handle_id =
       g_signal_connect(G_OBJECT(menu_), "hide", G_CALLBACK(OnMenuHidden), this);
 
   // Block until menu is no longer shown by running a nested message loop.
   MessageLoopForUI::current()->Run(NULL);
 
   g_signal_handler_disconnect(G_OBJECT(menu_), handle_id);
   menu_shown_ = false;
+
+  // Call into the model after the nested message loop quits. This way if the
+  // model ends up deleting us, or MessageLoop::Quit takes a while, there aren't
+  // any problems.
+  if (menu_activated_ && model_->IsEnabledAt(activated_index_) &&
+      MenuTypeCanExecute(model_->GetTypeAt(activated_index_))) {
+    model_->ActivatedAt(activated_index_);
+  }
 }
 
 void NativeMenuGtk::CancelMenu() {
   NOTIMPLEMENTED();
 }
 
 void NativeMenuGtk::Rebuild() {
   ResetMenu();
 
   std::map<int, GtkRadioMenuItem*> radio_groups_;
@@ skipping 178 matching lines @@
   // Ignore the signal if it's sent to an inactive checked radio item.
   //
   // Suppose there are three radio items A, B, C, and A is now being
   // checked. If you click C, "activate" signal will be sent to A and C.
   // Here, we ignore the signal sent to A.
   if (GTK_IS_RADIO_MENU_ITEM(menu_item) &&
       !gtk_check_menu_item_get_active(GTK_CHECK_MENU_ITEM(menu_item))) {
     return;
   }
 
-  if (model_->IsEnabledAt(position) &&
-      MenuTypeCanExecute(model_->GetTypeAt(position))) {
-    model_->ActivatedAt(position);
-  }
+  menu_activated_ = true;
+  activated_index_ = position;
 }
 
 // static
 void NativeMenuGtk::CallActivate(GtkMenuItem* menu_item,
                                  NativeMenuGtk* native_menu) {
   native_menu->OnActivate(menu_item);
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // MenuWrapper, public:
 
 // static
 MenuWrapper* MenuWrapper::CreateWrapper(Menu2* menu) {
   return new NativeMenuGtk(menu->model());
 }
 
 }  // namespace views