Fix use-after-free in BrowserActionOverflowMenuController

chrome/browser/ui/views/extensions/browser_action_overflow_menu_controller.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_UI_VIEWS_EXTENSIONS_BROWSER_ACTION_OVERFLOW_MENU_CONTROLLER_H_
 #define CHROME_BROWSER_UI_VIEWS_EXTENSIONS_BROWSER_ACTION_OVERFLOW_MENU_CONTROLLER_H_
 
 #include <set>
 #include <vector>
 
@@ skipping 33 matching lines @@
       int start_index);
 
   void set_observer(Observer* observer) { observer_ = observer; }
 
   // Shows the overflow menu.
   bool RunMenu(views::Widget* widget, bool for_drop);
 
   // Closes the overflow menu (and its context menu if open as well).
   void CancelMenu();
 
+  // Notify the menu that the associated BrowserActionViews have been deleted.
+  void NotifyBrowserActionViewsDeleting();
+
   // Overridden from views::MenuDelegate:
   virtual bool IsCommandEnabled(int id) const OVERRIDE;
   virtual void ExecuteCommand(int id) OVERRIDE;
   virtual bool ShowContextMenu(views::MenuItemView* source,
                                int id,
                                const gfx::Point& p,
                                ui::MenuSourceType source_type) OVERRIDE;
   virtual void DropMenuClosed(views::MenuItemView* menu) OVERRIDE;
   // These drag functions offer support for dragging icons into the overflow
   // menu.
@@ skipping 58 matching lines @@
   // controller. The icon updater will update the menu item view's icon when
   // the browser action view's icon has been updated.
   ScopedVector<IconUpdater> icon_updaters_;
 
   friend class base::DeleteHelper<BrowserActionOverflowMenuController>;
 
   DISALLOW_COPY_AND_ASSIGN(BrowserActionOverflowMenuController);
 };
 
 #endif  // CHROME_BROWSER_UI_VIEWS_EXTENSIONS_BROWSER_ACTION_OVERFLOW_MENU_CONTROLLER_H_