[Extensions Toolbar Mac] Fix crash in browser action context menus

chrome/browser/ui/cocoa/extensions/browser_action_button.mm

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "chrome/browser/ui/cocoa/extensions/browser_action_button.h"
 
 #include <algorithm>
 #include <cmath>
 
 #include "base/logging.h"
@@ skipping 393 matching lines @@
 
   [self setNeedsDisplay:YES];
 }
 
 - (void)onRemoved {
   // The button is being removed from the toolbar, and the backing controller
   // will also be removed. Destroy the delegate.
   // We only need to do this because in Cocoa's memory management, removing the
   // button from the toolbar doesn't synchronously dealloc it.
   viewControllerDelegate_.reset();
+  // Also reset the context menu, since it has a dependency on the backing
+  // controller (which owns its model).
+  contextMenuController_.reset();
 }
 
 - (BOOL)isAnimating {
   return [moveAnimation_ isAnimating];
 }
 
 - (NSRect)frameAfterAnimation {
   if ([moveAnimation_ isAnimating]) {
     NSRect endFrame = [[[[moveAnimation_ viewAnimations] objectAtIndex:0]
         valueForKey:NSViewAnimationEndFrameKey] rectValue];
@@ skipping 34 matching lines @@
                             [browserActionsController_ currentWebContents]];
 
   [image unlockFocus];
   return image;
 }
 
 - (NSMenu*)menu {
   if (testContextMenu_)
     return testContextMenu_;
 
+  // Make sure we delete any references to an old menu.
+  contextMenuController_.reset();
+
   ui::MenuModel* contextMenu = viewController_->GetContextMenu();
   if (!contextMenu)
     return nil;
   contextMenuController_.reset(
       [[MenuController alloc] initWithModel:contextMenu
                      useWithPopUpButtonCell:NO]);
   return [contextMenuController_ menu];
 }
 
 #pragma mark -
@@ skipping 44 matching lines @@
 - (ui::ThemeProvider*)themeProviderForWindow:(NSWindow*)window {
   ui::ThemeProvider* themeProvider = [window themeProvider];
   if (!themeProvider)
     themeProvider =
         [[browserActionsController_ browser]->window()->GetNativeWindow()
             themeProvider];
   return themeProvider;
 }
 
 @end