Fixes possible crash if the window hosting a menu was closed while the

views/controls/menu/menu_host_win.cc

Index: views/controls/menu/menu_host_win.cc
diff --git a/views/controls/menu/menu_host_win.cc b/views/controls/menu/menu_host_win.cc
index f2c2c2c36b79c00afd194c9489c7600b010d00e2..384229faaa7970dd2ff4c9b56c881f51ba860e09 100644
--- a/views/controls/menu/menu_host_win.cc
+++ b/views/controls/menu/menu_host_win.cc
@@ -12,8 +12,13 @@
 
 namespace views {
 
-MenuHost::MenuHost(SubmenuView* submenu)
-    : closed_(false),
+// static
+MenuHost* MenuHost::Create(SubmenuView* submenu_view) {
+  return new MenuHostWin(submenu_view);
+}
+
+MenuHostWin::MenuHostWin(SubmenuView* submenu)
+    : destroying_(false),
       submenu_(submenu),
       owns_capture_(false) {
   set_window_style(WS_POPUP);
@@ -30,88 +35,96 @@ MenuHost::MenuHost(SubmenuView* submenu)
   set_window_ex_style(WS_EX_TOPMOST | WS_EX_NOACTIVATE);
 }
 
-void MenuHost::Init(HWND parent,
-                    const gfx::Rect& bounds,
-                    View* contents_view,
-                    bool do_capture) {
+MenuHostWin::~MenuHostWin() {
+}
+
+void MenuHostWin::Init(HWND parent,
+                       const gfx::Rect& bounds,
+                       View* contents_view,
+                       bool do_capture) {
   WidgetWin::Init(parent, bounds);
   SetContentsView(contents_view);
-  Show();
-  if (do_capture)
-    DoCapture();
+  ShowMenuHost(do_capture);
 }
 
-void MenuHost::Show() {
+bool MenuHostWin::IsMenuHostVisible() {
+  return IsVisible();
+}
+
+void MenuHostWin::ShowMenuHost(bool do_capture) {
   // We don't want to take focus away from the hosting window.
   ShowWindow(SW_SHOWNA);
-}
 
-void MenuHost::Hide() {
-  if (closed_) {
-    // We're already closed, nothing to do.
-    // This is invoked twice if the first time just hid us, and the second
-    // time deleted Closed (deleted) us.
-    return;
-  }
-  // The menus are freed separately, and possibly before the window is closed,
-  // remove them so that View doesn't try to access deleted objects.
-  static_cast<MenuHostRootView*>(GetRootView())->suspend_events();
-  GetRootView()->RemoveAllChildViews(false);
-  closed_ = true;
-  ReleaseCapture();
-  WidgetWin::Hide();
+  if (do_capture)
+    DoCapture();
 }
 
-void MenuHost::HideWindow() {
+void MenuHostWin::HideMenuHost() {
   // Make sure we release capture before hiding.
-  ReleaseCapture();
+  ReleaseMenuHostCapture();
+
   WidgetWin::Hide();
 }
 
-void MenuHost::OnCaptureChanged(HWND hwnd) {
-  WidgetWin::OnCaptureChanged(hwnd);
-  owns_capture_ = false;
-#ifdef DEBUG_MENU
-  DLOG(INFO) << "Capture changed";
-#endif
+void MenuHostWin::DestroyMenuHost() {
+  HideMenuHost();
+  destroying_ = true;
+  CloseNow();
 }
 
-void MenuHost::DoCapture() {
-  owns_capture_ = true;
-  SetCapture();
-  has_capture_ = true;
-#ifdef DEBUG_MENU
-  DLOG(INFO) << "Doing capture";
-#endif
+void MenuHostWin::SetMenuHostBounds(const gfx::Rect& bounds) {
+  SetBounds(bounds);
 }
 
-void MenuHost::ReleaseCapture() {
+void MenuHostWin::ReleaseMenuHostCapture() {
   if (owns_capture_) {
-#ifdef DEBUG_MENU
-    DLOG(INFO) << "released capture";
-#endif
     owns_capture_ = false;
     ::ReleaseCapture();
   }
 }
 
-RootView* MenuHost::CreateRootView() {
-  return new MenuHostRootView(this, submenu_);
+gfx::NativeWindow MenuHostWin::GetMenuHostWindow() {
+  return GetNativeView();
+}
+
+void MenuHostWin::OnDestroy() {
+  if (!destroying_) {
+    // We weren't explicitly told to destroy ourselves, which means the menu was
+    // deleted out from under us (the window we're parented to was closed). Tell
+    // the SubmenuView to drop references to us.
+    submenu_->MenuHostDestroyed();
+  }
+  WidgetWin::OnDestroy();
 }
 
-void MenuHost::OnCancelMode() {
-  if (!closed_) {
+void MenuHostWin::OnCaptureChanged(HWND hwnd) {
+  WidgetWin::OnCaptureChanged(hwnd);
+  owns_capture_ = false;
 #ifdef DEBUG_MENU
-    DLOG(INFO) << "OnCanceMode, closing menu";
+  DLOG(INFO) << "Capture changed";
 #endif
-    submenu_->GetMenuItem()->GetMenuController()->Cancel(true);
-  }
 }
 
-// Overriden to return false, we do NOT want to release capture on mouse
-// release.
-bool MenuHost::ReleaseCaptureOnMouseReleased() {
+void MenuHostWin::OnCancelMode() {
+  submenu_->GetMenuItem()->GetMenuController()->Cancel(
+      MenuController::EXIT_ALL);
+}
+
+RootView* MenuHostWin::CreateRootView() {
+  return new MenuHostRootView(this, submenu_);
+}
+
+bool MenuHostWin::ReleaseCaptureOnMouseReleased() {
   return false;
 }
 
+void MenuHostWin::DoCapture() {
+  owns_capture_ = true;
+  SetCapture();
+  has_capture_ = true;
+#ifdef DEBUG_MENU
+  DLOG(INFO) << "Doing capture";
+#endif
+}
+
 }  // namespace views