Turn Bookmark Menus Async

ui/views/controls/menu/menu_controller.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/views/controls/menu/menu_controller.h"
 
 #include "base/i18n/case_conversion.h"
 #include "base/i18n/rtl.h"
 #include "base/macros.h"
 #include "base/strings/utf_string_conversions.h"
@@ skipping 483 matching lines @@
 
   // The nested message loop could have been killed externally. Check to see if
   // there are nested asynchronous menus to shutdown.
   if (async_run_ && delegate_stack_.size() > 1)
     ExitAsyncRun();
 
   return ExitMenuRun();
 }
 
 void MenuController::Cancel(ExitType type) {
+  // If not currently active, this controller could have been destroyed, and a
+  // menu is attempting to cancel after destruction. No futher canellation is
+  // needed.
+  if (GetActiveInstance() != this)

[sky, 2016/07/21 16:07:54]

Your comment sort of implies this may be called on a deleted object. Is that the
case?

[jonross, 2016/07/21 18:30:25]

Correct, MenuItemViews hold onto a raw pointer to their MenuController.
Currently they are unaware of the MC being destroyed.

+    return;
+
   // If the menu has already been destroyed, no further cancellation is
   // needed.  We especially don't want to set the |exit_type_| to a lesser
   // value.
   if (exit_type_ == EXIT_DESTROYED || exit_type_ == type)
     return;
 
   if (!showing_) {
     // This occurs if we're in the process of notifying the delegate for a drop
     // and the delegate cancels us.
     return;
@@ skipping 2189 matching lines @@
   if (hot_button_)
     hot_button_->SetHotTracked(false);
   hot_button_ = hot_button;
   if (hot_button) {
     hot_button->SetHotTracked(true);
     hot_button->NotifyAccessibilityEvent(ui::AX_EVENT_SELECTION, true);
   }
 }
 
 }  // namespace views