Fix use-after-free in BrowserActionView::~BrowserActionView()

chrome/browser/ui/views/toolbar/browser_action_view.h

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_UI_VIEWS_TOOLBAR_BROWSER_ACTION_VIEW_H_
 #define CHROME_BROWSER_UI_VIEWS_TOOLBAR_BROWSER_ACTION_VIEW_H_
 
 #include "chrome/browser/ui/views/extensions/extension_action_view_controller.h"
 #include "chrome/browser/ui/views/extensions/extension_action_view_delegate.h"
 #include "content/public/browser/notification_observer.h"
@@ skipping 151 matching lines @@
   virtual ExtensionActionViewController* GetPreferredPopupViewController()
       OVERRIDE;
   virtual views::View* GetReferenceViewForPopup() OVERRIDE;
   virtual views::MenuButton* GetContextMenuButton() OVERRIDE;
   virtual content::WebContents* GetCurrentWebContents() OVERRIDE;
   virtual void HideActivePopup() OVERRIDE;
   virtual void OnIconUpdated() OVERRIDE;
   virtual void OnPopupShown(bool grant_tab_permissions) OVERRIDE;
   virtual void CleanupPopup() OVERRIDE;
 
+  // A lock to keep the MenuButton pressed when a menu or popup is visible.
+  // This needs to be destroyed after |view_controller_|, because
+  // |view_controller_|'s destructor can call CleanupPopup(), which uses this
+  // object.
+  scoped_ptr<views::MenuButton::PressedLock> pressed_lock_;
+
   // The controller for this ExtensionAction view.
   scoped_ptr<ExtensionActionViewController> view_controller_;
 
   // Delegate that usually represents a container for BrowserActionView.
   BrowserActionView::Delegate* delegate_;
 
   // Used to make sure we only register the command once.
   bool called_registered_extension_command_;
 
   content::NotificationRegistrar registrar_;
 
   // The observer that we need to notify when the icon of the button has been
   // updated.
   IconObserver* icon_observer_;
 
-  // A lock to keep the MenuButton pressed when a menu or popup is visible.
-  scoped_ptr<views::MenuButton::PressedLock> pressed_lock_;
-
   DISALLOW_COPY_AND_ASSIGN(BrowserActionView);
 };
 
 #endif  // CHROME_BROWSER_UI_VIEWS_TOOLBAR_BROWSER_ACTION_VIEW_H_