GTK: own a widget that was being accessed after destruction.

chrome/browser/gtk/browser_toolbar_gtk.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/gtk/browser_toolbar_gtk.h"
 
 #include <gdk/gdkkeysyms.h>
 #include <gtk/gtk.h>
 #include <X11/XF86keysym.h>
 
@@ skipping 108 matching lines @@
   browser_->command_updater()->RemoveCommandObserver(IDC_FORWARD, this);
   browser_->command_updater()->RemoveCommandObserver(IDC_HOME, this);
   browser_->command_updater()->RemoveCommandObserver(IDC_BOOKMARK_PAGE, this);
 
   offscreen_entry_.Destroy();
 
   page_menu_.reset();
   app_menu_.reset();
   page_menu_button_.Destroy();
   app_menu_button_.Destroy();
+  app_menu_image_.Destroy();
 }
 
 void BrowserToolbarGtk::Init(Profile* profile,
                              GtkWindow* top_level_window) {
   // Make sure to tell the location bar the profile before calling its Init.
   SetProfile(profile);
 
   theme_provider_ = GtkThemeProvider::GetFrom(profile);
   offscreen_entry_.Own(gtk_entry_new());
 
@@ skipping 79 matching lines @@
 
     page_menu_.reset(new MenuGtk(this, &page_menu_model_));
     gtk_box_pack_start(GTK_BOX(menus_hbox), page_menu, FALSE, FALSE, 0);
   }
 
   GtkWidget* chrome_menu = BuildToolbarMenuButton(
       l10n_util::GetStringFUTF8(IDS_APPMENU_TOOLTIP,
           WideToUTF16(l10n_util::GetString(IDS_PRODUCT_NAME))),
       &app_menu_button_);
   menu_bar_helper_.Add(app_menu_button_.get());
-  app_menu_image_ = gtk_image_new_from_pixbuf(
-      theme_provider_->GetRTLEnabledPixbufNamed(IDR_MENU_CHROME));
-  gtk_container_add(GTK_CONTAINER(chrome_menu), app_menu_image_);
-  g_signal_connect_after(app_menu_image_, "expose-event",
+  app_menu_image_.Own(gtk_image_new_from_pixbuf(
+      theme_provider_->GetRTLEnabledPixbufNamed(IDR_MENU_CHROME)));
+  gtk_container_add(GTK_CONTAINER(chrome_menu), app_menu_image_.get());
+  g_signal_connect_after(app_menu_image_.get(), "expose-event",
                          G_CALLBACK(OnAppMenuImageExposeThunk), this);
 
   if (use_wrench_menu)
     app_menu_.reset(new MenuGtk(this, &wrench_menu_model_));
   else
     app_menu_.reset(new MenuGtk(this, &app_menu_model_));
   gtk_box_pack_start(GTK_BOX(menus_hbox), chrome_menu, FALSE, FALSE, 0);
   gtk_box_pack_start(GTK_BOX(toolbar_right_), menus_hbox, FALSE, FALSE,
                      kToolbarWidgetSpacing);
   g_signal_connect(app_menu_->widget(), "show",
@@ skipping 176 matching lines @@
           GTK_CONTAINER(page_menu_button_.get()), border);
     }
     gtk_container_set_border_width(
         GTK_CONTAINER(app_menu_button_.get()), border);
 
     // Update the menu button images.
     if (page_menu_button_.get()) {
       gtk_image_set_from_pixbuf(GTK_IMAGE(page_menu_image_),
           theme_provider_->GetRTLEnabledPixbufNamed(IDR_MENU_PAGE));
     }
-    gtk_image_set_from_pixbuf(GTK_IMAGE(app_menu_image_),
+    gtk_image_set_from_pixbuf(GTK_IMAGE(app_menu_image_.get()),
         theme_provider_->GetRTLEnabledPixbufNamed(IDR_MENU_CHROME));
 
     // Force the height of the toolbar so we get the right amount of padding
     // above and below the location bar. We always force the size of the hboxes
     // to either side of the location box, but we only force the location box
     // size in chrome-theme mode because that's the only time we try to control
     // the font size.
     int toolbar_height = ShouldOnlyShowLocation() ?
                          kToolbarHeightLocationBarOnly : kToolbarHeight;
     gtk_widget_set_size_request(toolbar_left_, -1, toolbar_height);
@@ skipping 337 matching lines @@
   if (other_button)
     PopupForButton(other_button);
 }
 
 void BrowserToolbarGtk::AnimationEnded(const Animation* animation) {
   AnimationProgressed(animation);
 }
 
 void BrowserToolbarGtk::AnimationProgressed(const Animation* animation) {
   DCHECK_EQ(animation, &upgrade_reminder_animation_);
-  gtk_widget_queue_draw(app_menu_image_);
+  gtk_widget_queue_draw(app_menu_image_.get());
 }
 
 void BrowserToolbarGtk::AnimationCanceled(const Animation* animation) {
   AnimationProgressed(animation);
 }
 
 void BrowserToolbarGtk::OnAppMenuShow(GtkWidget* sender) {
   upgrade_reminder_animation_.Reset();
 }
 
@@ skipping 20 matching lines @@
   int x_offset = base::i18n::IsRTL() ?
       sender->allocation.width - kUpgradeDotOffset - badge.width() :
       kUpgradeDotOffset;
   canvas.DrawBitmapInt(
       badge,
       sender->allocation.x + x_offset,
       sender->allocation.y + sender->allocation.height - badge.height());
 
   return FALSE;
 }