Stop MenuItemView From Directly Caching MenuController

ui/views/controls/menu/menu_controller_unittest.cc

Index: ui/views/controls/menu/menu_controller_unittest.cc
diff --git a/ui/views/controls/menu/menu_controller_unittest.cc b/ui/views/controls/menu/menu_controller_unittest.cc
index 70aded93ba9e3e141f363e8160e635bdf72062be..d88ea756b8de10ecd510aec4e57b4f9b1b6628c6 100644
--- a/ui/views/controls/menu/menu_controller_unittest.cc
+++ b/ui/views/controls/menu/menu_controller_unittest.cc
@@ -24,6 +24,7 @@
 #include "ui/views/controls/menu/menu_controller_delegate.h"
 #include "ui/views/controls/menu/menu_delegate.h"
 #include "ui/views/controls/menu/menu_host.h"
+#include "ui/views/controls/menu/menu_host_root_view.h"
 #include "ui/views/controls/menu/menu_item_view.h"
 #include "ui/views/controls/menu/menu_message_loop.h"
 #include "ui/views/controls/menu/menu_scroll_view_container.h"
@@ -31,6 +32,7 @@
 #include "ui/views/test/menu_test_utils.h"
 #include "ui/views/test/test_views_delegate.h"
 #include "ui/views/test/views_test_base.h"
+#include "ui/views/widget/root_view.h"
 
 #if defined(USE_AURA)
 #include "ui/aura/client/drag_drop_client.h"
@@ -506,6 +508,10 @@ class MenuControllerTest : public ViewsTestBase {
 
   MenuHost* GetMenuHost(SubmenuView* submenu) { return submenu->host_; }
 
+  MenuHostRootView* CreateMenuHostRootView(MenuHost* host) {
+    return static_cast<MenuHostRootView*>(host->CreateRootView());
+  }
+
   void MenuHostOnDragWillStart(MenuHost* host) { host->OnDragWillStart(); }
 
   void MenuHostOnDragComplete(MenuHost* host) { host->OnDragComplete(); }
@@ -607,7 +613,6 @@ class MenuControllerTest : public ViewsTestBase {
     menu_controller_->ExitMenuRun();
   }
 
- private:
   void DestroyMenuController() {
     if (!menu_controller_)
       return;
@@ -621,6 +626,7 @@ class MenuControllerTest : public ViewsTestBase {
     menu_controller_ = nullptr;
   }
 
+ private:
   void Init() {
     owner_.reset(new Widget);
     Widget::InitParams params = CreateParams(Widget::InitParams::TYPE_POPUP);
@@ -1192,6 +1198,28 @@ TEST_F(MenuControllerTest, AsynchronousDragHostDeleted) {
   MenuHostOnDragComplete(host);
 }
 
+// Widget destruction and cleanup occurs on the MessageLoop after the
+// MenuController has been destroyed. A MenuHostRootView should not attempt to
+// access a destroyed MenuController. This test should not cause a crash.
+TEST_F(MenuControllerTest, HostReceivesInputBeforeDestruction) {
+  MenuController* controller = menu_controller();
+  controller->SetAsyncRun(true);
+
+  SubmenuView* submenu = menu_item()->GetSubmenu();
+  submenu->ShowAt(owner(), menu_item()->bounds(), false);
+  gfx::Point location(submenu->bounds().bottom_right());
+  location.Offset(1, 1);
+
+  MenuHost* host = GetMenuHost(submenu);
+  MenuHostRootView* root_view = CreateMenuHostRootView(host);
+  DestroyMenuController();
+
+  ui::MouseEvent event(ui::ET_MOUSE_MOVED, location, location,
+                       ui::EventTimeForNow(), ui::EF_LEFT_MOUSE_BUTTON, 0);
+
+  root_view->OnMouseMoved(event);
+}
+
 // Tets that an asynchronous menu nested within an asynchronous menu closes both
 // menus, and notifies both delegates.
 TEST_F(MenuControllerTest, DoubleAsynchronousNested) {