ash: Fix clusterfuzz crash in AddShelfOptionsMenu

chrome/browser/ui/ash/chrome_shell_delegate.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/ash/chrome_shell_delegate.h"
 
 #include <stddef.h>
 
 #include <limits>
 
@@ skipping 461 matching lines @@
   if (!shelf_delegate_) {
     shelf_delegate_ = new ChromeLauncherControllerImpl(nullptr, model);
     shelf_delegate_->Init();
   }
   return shelf_delegate_;
 }
 
 ui::MenuModel* ChromeShellDelegate::CreateContextMenu(
     ash::WmShelf* wm_shelf,
     const ash::ShelfItem* item) {
-  DCHECK(shelf_delegate_);
   // Don't show context menu for exclusive app runtime mode.
   if (chrome::IsRunningInAppMode())
     return nullptr;
 
+  // No context menu before |shelf_delegate_| is created. This is possible
+  // now because CreateShelfDelegate is called by session state change
+  // via mojo asynchronously. Context menu could be triggered when the
+  // mojo message is still in-fly and crashes.
+  if (!shelf_delegate_)
+    return nullptr;
+
   return LauncherContextMenu::Create(shelf_delegate_, item, wm_shelf);
 }
 
 ash::GPUSupport* ChromeShellDelegate::CreateGPUSupport() {
   // Chrome uses real GPU support.
   return new ash::GPUSupportImpl;
 }
 
 base::string16 ChromeShellDelegate::GetProductName() const {
   return l10n_util::GetStringUTF16(IDS_PRODUCT_NAME);
@@ skipping 97 matching lines @@
       NOTREACHED() << "Unexpected notification " << type;
   }
 }
 
 void ChromeShellDelegate::PlatformInit() {
   registrar_.Add(this, chrome::NOTIFICATION_LOGIN_USER_PROFILE_PREPARED,
                  content::NotificationService::AllSources());
   registrar_.Add(this, chrome::NOTIFICATION_SESSION_STARTED,
                  content::NotificationService::AllSources());
 }