Turn Bookmark Menus Async

ui/views/controls/menu/menu_controller.cc

Index: ui/views/controls/menu/menu_controller.cc
diff --git a/ui/views/controls/menu/menu_controller.cc b/ui/views/controls/menu/menu_controller.cc
index 13d3d3510a45b4cd6a2c358c51e9ff51703bdaca..d4ce542a492d69d60c775147472f90b51472e7e7 100644
--- a/ui/views/controls/menu/menu_controller.cc
+++ b/ui/views/controls/menu/menu_controller.cc
@@ -501,6 +501,12 @@ MenuItemView* MenuController::Run(Widget* parent,
 }
 
 void MenuController::Cancel(ExitType type) {
+  // If not currently active, this controller could have been destroyed, and a
+  // menu is attempting to cancel after destruction. No futher canellation is
+  // needed.
+  if (GetActiveInstance() != this)

[sky, 2016/07/21 16:07:54]

Your comment sort of implies this may be called on a deleted object. Is that the
case?

[jonross, 2016/07/21 18:30:25]

Correct, MenuItemViews hold onto a raw pointer to their MenuController.
Currently they are unaware of the MC being destroyed.

+    return;
+
   // If the menu has already been destroyed, no further cancellation is
   // needed.  We especially don't want to set the |exit_type_| to a lesser
   // value.