Merge Prevent nested Menu Cancelling

Merge Prevent nested Menu Cancelling
Prevent nested Menu Cancelling

When being cancelled MenuController will release ViewsDelegate. This is normally
used to prevent shutdown while menus are alive. The release can lead to views
teardowns attempting to cancel the MenuController and to delete the MenuRunner.

This nested cancelling and deletion of the MenuRunner leads to a use-after-free
once the original cancelling resumes.

This change updates MenuController::Cancel to mark the menu as not showing
earlier in the process. So that nested calls to Cancel are rejected.

TEST=MenuRunnerDestructionTest.MenuRunnerDestroyedDuringReleaseRef
BUG=683087
TBR=sky@chromium.org
NOTRY=true
NOPRESUBMIT=true

Review-Url: https://codereview.chromium.org/2680863002
Cr-Commit-Position: refs/heads/master@{#448792}
(cherry picked from commit 212e6fd564db2eef90c3855ab96cb75f35cba32d)

Review-Url: https://codereview.chromium.org/2682363002
Cr-Commit-Position: refs/branch-heads/2987@{#410}
Cr-Branched-From: ad51088c0e8776e8dcd963dbe752c4035ba6dab6-refs/heads/master@{#444943}
Committed: https://chromium.googlesource.com/chromium/src/+/b23180daa22d99ae5c6cb2eaf5856e71701f01de

[jonross, 2017-02-09 18:09:41]

Description was changed from

==========
Merge Prevent nested Menu Cancelling
Prevent nested Menu Cancelling

When being cancelled MenuController will release ViewsDelegate. This is normally
used to prevent shutdown while menus are alive. The release can lead to views
teardowns attempting to cancel the MenuController and to delete the MenuRunner.

This nested cancelling and deletion of the MenuRunner leads to a use-after-free
once the original cancelling resumes.

This change updates MenuController::Cancel to mark the menu as not showing
earlier in the process. So that nested calls to Cancel are rejected.

TEST=MenuRunnerDestructionTest.MenuRunnerDestroyedDuringReleaseRef
BUG=683087

Review-Url: https://codereview.chromium.org/2680863002
Cr-Commit-Position: refs/heads/master@{#448792}
(cherry picked from commit 212e6fd564db2eef90c3855ab96cb75f35cba32d)
==========

to

==========
Merge Prevent nested Menu Cancelling
Prevent nested Menu Cancelling

When being cancelled MenuController will release ViewsDelegate. This is normally
used to prevent shutdown while menus are alive. The release can lead to views
teardowns attempting to cancel the MenuController and to delete the MenuRunner.

This nested cancelling and deletion of the MenuRunner leads to a use-after-free
once the original cancelling resumes.

This change updates MenuController::Cancel to mark the menu as not showing
earlier in the process. So that nested calls to Cancel are rejected.

TEST=MenuRunnerDestructionTest.MenuRunnerDestroyedDuringReleaseRef
BUG=683087
TBR=sky@chromium.org
NOTRY=true
NOPRESUBMIT=true

Review-Url: https://codereview.chromium.org/2680863002
Cr-Commit-Position: refs/heads/master@{#448792}
(cherry picked from commit 212e6fd564db2eef90c3855ab96cb75f35cba32d)
==========

[jonross, 2017-02-09 18:09:41]

jonross@chromium.org changed reviewers:
+ sky@chromium.org

[jonross, 2017-02-09 18:09:45]

The CQ bit was checked by jonross@chromium.org

[commit-bot: I haz the power, 2017-02-09 18:10:23]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-02-09 18:15:07]

CQ is committing da patch.

Bot data: {"patchset_id": 1, "attempt_start_ts": 1486663785720580, "parent_rev":
"2902a5652e294c7867d9cb2b92d4e963c2be9073", "commit_rev":
"b23180daa22d99ae5c6cb2eaf5856e71701f01de"}

[commit-bot: I haz the power, 2017-02-09 18:16:02]

Description was changed from

==========
Merge Prevent nested Menu Cancelling
Prevent nested Menu Cancelling

When being cancelled MenuController will release ViewsDelegate. This is normally
used to prevent shutdown while menus are alive. The release can lead to views
teardowns attempting to cancel the MenuController and to delete the MenuRunner.

This nested cancelling and deletion of the MenuRunner leads to a use-after-free
once the original cancelling resumes.

This change updates MenuController::Cancel to mark the menu as not showing
earlier in the process. So that nested calls to Cancel are rejected.

TEST=MenuRunnerDestructionTest.MenuRunnerDestroyedDuringReleaseRef
BUG=683087
TBR=sky@chromium.org
NOTRY=true
NOPRESUBMIT=true

Review-Url: https://codereview.chromium.org/2680863002
Cr-Commit-Position: refs/heads/master@{#448792}
(cherry picked from commit 212e6fd564db2eef90c3855ab96cb75f35cba32d)
==========

to

==========
Merge Prevent nested Menu Cancelling
Prevent nested Menu Cancelling

When being cancelled MenuController will release ViewsDelegate. This is normally
used to prevent shutdown while menus are alive. The release can lead to views
teardowns attempting to cancel the MenuController and to delete the MenuRunner.

This nested cancelling and deletion of the MenuRunner leads to a use-after-free
once the original cancelling resumes.

This change updates MenuController::Cancel to mark the menu as not showing
earlier in the process. So that nested calls to Cancel are rejected.

TEST=MenuRunnerDestructionTest.MenuRunnerDestroyedDuringReleaseRef
BUG=683087
TBR=sky@chromium.org
NOTRY=true
NOPRESUBMIT=true

Review-Url: https://codereview.chromium.org/2680863002
Cr-Commit-Position: refs/heads/master@{#448792}
(cherry picked from commit 212e6fd564db2eef90c3855ab96cb75f35cba32d)

Review-Url: https://codereview.chromium.org/2682363002
Cr-Commit-Position: refs/branch-heads/2987@{#410}
Cr-Branched-From:
ad51088c0e8776e8dcd963dbe752c4035ba6dab6-refs/heads/master@{#444943}
Committed:
https://chromium.googlesource.com/chromium/src/+/b23180daa22d99ae5c6cb2eaf585...
==========

[commit-bot: I haz the power, 2017-02-09 18:16:03]

Committed patchset #1 (id:1) as
https://chromium.googlesource.com/chromium/src/+/b23180daa22d99ae5c6cb2eaf585...