Fix use-after-free in BrowserActionOverflowMenuController

chrome/browser/ui/views/toolbar/browser_actions_container.cc

Index: chrome/browser/ui/views/toolbar/browser_actions_container.cc
diff --git a/chrome/browser/ui/views/toolbar/browser_actions_container.cc b/chrome/browser/ui/views/toolbar/browser_actions_container.cc
index d935524540f9a19c9e4c5bbd65a5084b5f4304ed..097e1e715d16add9bffd00b39f903133a65ef88b 100644
--- a/chrome/browser/ui/views/toolbar/browser_actions_container.cc
+++ b/chrome/browser/ui/views/toolbar/browser_actions_container.cc
@@ -236,6 +236,8 @@ void BrowserActionsContainer::CreateBrowserActionViews() {
 
 void BrowserActionsContainer::DeleteBrowserActionViews() {
   HidePopup();
+  if (overflow_menu_)

[msw, 2014/07/09 16:56:27]

Can we simply close the overflow menu on DeleteBrowserActionViews?

[Devlin, 2014/07/09 19:23:27]

I'm not sure that we can safely - DeleteBrowserActionViews() can be called as a
result of moving browser actions, which can be triggered by the overflow menu. 
So it the flow would become:

OverflowMenu::OnDrop
  MoveBrowserAction()
  Finish()

MoveBrowserAction()
  DeleteBrowserActions()
  ...

DeleteBrowserActions()
  CloseOverflowMenu()
  Delete...

(All pseudocode, obviously).  The problem is that the menu would be canceled via
the call to close, but then would try to finish.

+    overflow_menu_->NotifyBrowserActionViewsDeleting();
   STLDeleteElements(&browser_action_views_);
 }