Fix MenuRunner Releasing

ui/views/controls/menu/menu_runner_impl.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/views/controls/menu/menu_runner_impl.h"
 
 #include "build/build_config.h"
 #include "ui/native_theme/native_theme.h"
 #include "ui/views/controls/button/menu_button.h"
 #include "ui/views/controls/menu/menu_controller.h"
@@ skipping 44 matching lines @@
     delete_after_run_ = true;
 
     // Swap in a different delegate. That way we know the original MenuDelegate
     // won't be notified later on (when it's likely already been deleted).
     if (!empty_delegate_.get())
       empty_delegate_.reset(new MenuDelegate());
     menu_->set_delegate(empty_delegate_.get());
 
     // Verify that the MenuController is still active. It may have been
     // destroyed out of order.
-    if (MenuController::GetActiveInstance()) {
-      DCHECK(controller_);
+    if (controller_) {
       // Release is invoked when MenuRunner is destroyed. Assume this is
       // happening because the object referencing the menu has been destroyed
       // and the menu button is no longer valid.
       controller_->Cancel(MenuController::EXIT_DESTROYED);
       return;
     }
   }
 
   delete this;
 }
@@ skipping 42 matching lines @@
   for_drop_ = (run_types & MenuRunner::FOR_DROP) != 0;
   bool has_mnemonics = (run_types & MenuRunner::HAS_MNEMONICS) != 0;
   owns_controller_ = false;
   if (!controller) {
     // No menus are showing, show one.
     controller = new MenuController(!for_drop_, this);
     owns_controller_ = true;
   }
   controller->SetAsyncRun(async_);
   controller->set_is_combobox((run_types & MenuRunner::COMBOBOX) != 0);
-  controller_ = controller;
-  menu_->set_controller(controller_);
+  controller_ = controller->AsWeakPtr();
+  menu_->set_controller(controller_.get());
   menu_->PrepareForRun(owns_controller_,
                        has_mnemonics,
                        !for_drop_ && ShouldShowMnemonics(button));
 
   // Run the loop.
   int mouse_event_flags = 0;
   MenuItemView* result =
       controller->Run(parent,
                       button,
                       menu_,
@@ skipping 39 matching lines @@
        ++i)
     delete *i;
 }
 
 MenuRunner::RunResult MenuRunnerImpl::MenuDone(NotifyType type,
                                                MenuItemView* result,
                                                int mouse_event_flags) {
   menu_->RemoveEmptyMenus();
   menu_->set_controller(nullptr);
 
-  if (owns_controller_) {
+  if (owns_controller_ && controller_) {
     // We created the controller and need to delete it.
-    delete controller_;
+    delete controller_.get();
     owns_controller_ = false;
   }
   controller_ = nullptr;
   // Make sure all the windows we created to show the menus have been
   // destroyed.
   menu_->DestroyAllMenuHosts();
   if (delete_after_run_) {
     delete this;
     return MenuRunner::MENU_DELETED;
   }
@@ skipping 21 matching lines @@
 #if defined(OS_WIN)
   // This is only needed on Windows.
   if (!show_mnemonics)
     show_mnemonics = ui::win::IsAltPressed();
 #endif
   return show_mnemonics;
 }
 
 }  // namespace internal
 }  // namespace views