Fix use-after-free in BrowserActionOverflowMenuController

chrome/browser/ui/views/extensions/browser_action_overflow_menu_controller.cc

Index: chrome/browser/ui/views/extensions/browser_action_overflow_menu_controller.cc
diff --git a/chrome/browser/ui/views/extensions/browser_action_overflow_menu_controller.cc b/chrome/browser/ui/views/extensions/browser_action_overflow_menu_controller.cc
index 4bc75b8313ca1338d0164545806759fd3c672de1..9c850ddd2444600313ba0dd14fe842f0d1f053a3 100644
--- a/chrome/browser/ui/views/extensions/browser_action_overflow_menu_controller.cc
+++ b/chrome/browser/ui/views/extensions/browser_action_overflow_menu_controller.cc
@@ -30,8 +30,7 @@
 // action button's icon has been updated.
 class IconUpdater : public BrowserActionButton::IconObserver {
  public:
-  IconUpdater(views::MenuItemView* menu_item_view,
-              BrowserActionButton* button)
+  IconUpdater(views::MenuItemView* menu_item_view, BrowserActionButton* button)
       : menu_item_view_(menu_item_view),
         button_(button) {
     DCHECK(menu_item_view);
@@ -128,6 +127,10 @@ void BrowserActionOverflowMenuController::CancelMenu() {
   menu_->Cancel();
 }
 
+void BrowserActionOverflowMenuController::NotifyBrowserActionViewsDeleting() {
+  icon_updaters_.clear();
+}
+
 bool BrowserActionOverflowMenuController::IsCommandEnabled(int id) const {
   BrowserActionView* view = (*views_)[start_index_ + id - 1];
   return view->button()->IsEnabled(owner_->GetCurrentTabId());