Fix use-after-free in BrowserActionOverflowMenuController

chrome/browser/ui/views/extensions/browser_action_overflow_menu_controller.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/views/extensions/browser_action_overflow_menu_controller.h"
 
 #include "base/message_loop/message_loop.h"
 #include "base/strings/utf_string_conversions.h"
 #include "chrome/browser/extensions/extension_action.h"
 #include "chrome/browser/extensions/extension_action_manager.h"
@@ skipping 12 matching lines @@
 
 // In the browser actions container's chevron menu, a menu item view's icon
 // comes from BrowserActionView::GetIconWithBadge() (which comes from the
 // browser action button's icon) when the menu item view is created. But, the
 // browser action button's icon may not be loaded in time because it is read
 // from file system in another thread.
 // The IconUpdater will update the menu item view's icon when the browser
 // action button's icon has been updated.
 class IconUpdater : public BrowserActionButton::IconObserver {
  public:
-  IconUpdater(views::MenuItemView* menu_item_view,
-              BrowserActionButton* button)
+  IconUpdater(views::MenuItemView* menu_item_view, BrowserActionButton* button)
       : menu_item_view_(menu_item_view),
         button_(button) {
     DCHECK(menu_item_view);
     DCHECK(button);
     button->set_icon_observer(this);
   }
   virtual ~IconUpdater() {
     button_->set_icon_observer(NULL);
   }
 
@@ skipping 76 matching lines @@
     // command.
     base::MessageLoop::current()->DeleteSoon(FROM_HERE, this);
   }
   return true;
 }
 
 void BrowserActionOverflowMenuController::CancelMenu() {
   menu_->Cancel();
 }
 
+void BrowserActionOverflowMenuController::NotifyBrowserActionViewsDeleting() {
+  icon_updaters_.clear();
+}
+
 bool BrowserActionOverflowMenuController::IsCommandEnabled(int id) const {
   BrowserActionView* view = (*views_)[start_index_ + id - 1];
   return view->button()->IsEnabled(owner_->GetCurrentTabId());
 }
 
 void BrowserActionOverflowMenuController::ExecuteCommand(int id) {
   BrowserActionView* view = (*views_)[start_index_ + id - 1];
   owner_->OnBrowserActionExecuted(view->button());
 }
 
@@ skipping 120 matching lines @@
 
 BrowserActionView* BrowserActionOverflowMenuController::ViewForId(
     int id, size_t* index) {
   // The index of the view being dragged (GetCommand gives a 1-based index into
   // the overflow menu).
   size_t view_index = owner_->VisibleBrowserActions() + id - 1;
   if (index)
     *index = view_index;
   return owner_->GetBrowserActionViewAt(view_index);
 }