Index: chrome/browser/extensions/menu_manager.cc |
diff --git a/chrome/browser/extensions/menu_manager.cc b/chrome/browser/extensions/menu_manager.cc |
index dc1abda3af58c2b0a44833209da90d3ea32761af..7bfaf2d878036e95e6b304c81feb3af05259602f 100644 |
--- a/chrome/browser/extensions/menu_manager.cc |
+++ b/chrome/browser/extensions/menu_manager.cc |
@@ -625,7 +625,6 @@ void MenuManager::ExecuteCommand(content::BrowserContext* context, |
if (item->type() == MenuItem::RADIO) |
RadioItemSelected(item); |
- std::unique_ptr<base::ListValue> args(new base::ListValue()); |
std::unique_ptr<base::DictionaryValue> properties( |
new base::DictionaryValue()); |
@@ -664,8 +663,14 @@ void MenuManager::ExecuteCommand(content::BrowserContext* context, |
webview_guest->view_instance_id()); |
} |
- base::DictionaryValue* raw_properties = properties.get(); |
+ auto args = base::MakeUnique<base::ListValue>(); |
+ args->Reserve(2); |
args->Append(std::move(properties)); |
+ // |properties| is invalidated at this time, which is why |args| needs to be |
+ // queried for the pointer. The obtained pointer is guaranteed to stay valid |
+ // even after further Appends, because enough storage was reserved above. |
+ base::DictionaryValue* raw_properties = nullptr; |
+ args->GetDictionary(0, &raw_properties); |
// Add the tab info to the argument list. |
// No tab info in a platform app. |