ProfileChooserVIew heap-use-after-free fix

chrome/browser/ui/views/frame/browser_view.cc

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/views/frame/browser_view.h"
 
 #include <algorithm>
 
 #include "base/auto_reset.h"
 #include "base/command_line.h"
@@ skipping 2504 matching lines @@
       // Do nothing.
       break;
   }
 #endif
 }
 
 void BrowserView::ShowAvatarBubbleFromAvatarButton(
     AvatarBubbleMode mode,
     const signin::ManageAccountsParams& manage_accounts_params) {
 #if defined(FRAME_AVATAR_BUTTON)
+  // Do not show avatar bubble if there is no avatar menu button.

[msw, 2015/09/14 17:12:04]

Instead of a no-op, just use the chrome menu button as the anchor here to see if
that fixes the defect. In https://codereview.chromium.org/264303006 I worked to
enable the avatar bubble (for the CTRL+M accelerator) in fullscreen mode and in
single user profile cases (where the button doesn't appear). In that CL I
anchored the bubble to (1) the chrome menu button for single-profile restored
windows or (2) the fullscreen bubble itself in fullscreen.

If we really don't want to support those cases, you should remove some of my
earlier work (and likely restore the profile manager observation to
enable/disable the bubble command when the profile count changes from 1<->2).

+  if (!frame_->GetNewAvatarMenuButton())
+    return;
   profiles::BubbleViewMode bubble_view_mode;
   profiles::TutorialMode tutorial_mode;
   profiles::BubbleViewModeFromAvatarBubbleMode(mode, &bubble_view_mode,
                                                &tutorial_mode);
   ProfileChooserView::ShowBubble(
       bubble_view_mode, tutorial_mode, manage_accounts_params,
       frame_->GetNewAvatarMenuButton(), views::BubbleBorder::TOP_RIGHT,
       views::BubbleBorder::ALIGN_EDGE_TO_ANCHOR_EDGE, browser());
   ProfileMetrics::LogProfileOpenMethod(ProfileMetrics::ICON_AVATAR_BUBBLE);
 #else
@@ skipping 100 matching lines @@
   return immersive_mode_controller()->IsEnabled();
 }
 
 views::Widget* BrowserView::GetBubbleAssociatedWidget() {
   return GetWidget();
 }
 
 gfx::Rect BrowserView::GetTopContainerBoundsInScreen() {
   return top_container_->GetBoundsInScreen();
 }