Views: fix a crash where in the browser actions container.

This crash didn't actually affect linux/views (for some reason the RunContextMenu() call seems to never return).

BUG=38964
TEST=crash an extension while the context menu for it is showing.

Review URL: http://codereview.chromium.org/1237004

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@42703 0039d316-1c4b-4281-b951-d872f2087c98

4 files changed, 44 insertions, 23 deletions

diff --git a/chrome/browser/views/browser_actions_container.cc b/chrome/browser/views/browser_actions_container.cc
index b23cb76..7ccaee8 100644
--- a/chrome/browser/views/browser_actions_container.cc
+++ b/chrome/browser/views/browser_actions_container.cc
@@ -125,7 +125,13 @@ BrowserActionButton::BrowserActionButton(Extension* extension,
                                Extension::kBrowserActionIconMaxSize));
 }
 
-BrowserActionButton::~BrowserActionButton() {
+void BrowserActionButton::Destroy() {
+  if (showing_context_menu_) {
+    context_menu_menu_->CancelMenu();
+    MessageLoop::current()->DeleteSoon(FROM_HERE, this);
+  } else {
+    delete this;
+  }
 }
 
 gfx::Insets BrowserActionButton::GetInsets() const {
@@ -235,6 +241,8 @@ bool BrowserActionButton::OnMousePressed(const views::MouseEvent& e) {
     context_menu_menu_->RunContextMenuAt(point);
 
     SetButtonNotPushed();
+    showing_context_menu_ = false;
+
     return false;
   } else if (IsPopup()) {
     return MenuButton::OnMousePressed(e);
@@ -276,6 +284,9 @@ void BrowserActionButton::SetButtonNotPushed() {
   menu_visible_ = false;
 }
 
+BrowserActionButton::~BrowserActionButton() {
+}
+
 
 ////////////////////////////////////////////////////////////////////////////////
 // BrowserActionView
@@ -289,6 +300,11 @@ BrowserActionView::BrowserActionView(Extension* extension,
   button_->UpdateState();
 }
 
+BrowserActionView::~BrowserActionView() {
+  RemoveChildView(button_);
+  button_->Destroy();
+}
+
 gfx::Canvas* BrowserActionView::GetIconWithBadge() {
   int tab_id = panel_->GetCurrentTabId();
 
diff --git a/chrome/browser/views/browser_actions_container.h b/chrome/browser/views/browser_actions_container.h
index 45cfaf9..de6048c 100644
--- a/chrome/browser/views/browser_actions_container.h
+++ b/chrome/browser/views/browser_actions_container.h
@@ -50,7 +50,9 @@ class BrowserActionButton : public views::MenuButton,
                             public NotificationObserver {
  public:
   BrowserActionButton(Extension* extension, BrowserActionsContainer* panel);
-  ~BrowserActionButton();
+
+  // Call this instead of delete.
+  void Destroy();
 
   ExtensionAction* browser_action() const { return browser_action_; }
   Extension* extension() { return extension_; }
@@ -94,10 +96,12 @@ class BrowserActionButton : public views::MenuButton,
 
   // Notifications when to set button state to pushed/not pushed (for when the
   // popup/context menu is hidden or shown by the container).
-  virtual void SetButtonPushed();
-  virtual void SetButtonNotPushed();
+  void SetButtonPushed();
+  void SetButtonNotPushed();
 
  private:
+  virtual ~BrowserActionButton();
+
   // The browser action this view represents. The ExtensionAction is not owned
   // by this class.
   ExtensionAction* browser_action_;
@@ -124,6 +128,8 @@ class BrowserActionButton : public views::MenuButton,
 
   NotificationRegistrar registrar_;
 
+  friend class DeleteTask<BrowserActionButton>;
+
   DISALLOW_COPY_AND_ASSIGN(BrowserActionButton);
 };
 
@@ -136,6 +142,8 @@ class BrowserActionButton : public views::MenuButton,
 class BrowserActionView : public views::View {
  public:
   BrowserActionView(Extension* extension, BrowserActionsContainer* panel);
+  virtual ~BrowserActionView();
+
   BrowserActionButton* button() { return button_; }
 
   // Allocates a canvas object on the heap and draws into it the icon for the
diff --git a/views/controls/menu/native_menu_gtk.cc b/views/controls/menu/native_menu_gtk.cc
index 012d2a8..a10e130 100644
--- a/views/controls/menu/native_menu_gtk.cc
+++ b/views/controls/menu/native_menu_gtk.cc
@@ -112,11 +112,11 @@ void NativeMenuGtk::RunMenuAt(const gfx::Point& point, int alignment) {
   // Listen for "hide" signal so that we know when to return from the blocking
   // RunMenuAt call.
   gint hide_handle_id =
-      g_signal_connect(menu_, "hide", G_CALLBACK(OnMenuHidden), this);
+      g_signal_connect(menu_, "hide", G_CALLBACK(OnMenuHiddenThunk), this);
 
   gint move_handle_id =
-      g_signal_connect(menu_, "move-current", G_CALLBACK(OnMenuMoveCurrent),
-                       this);
+      g_signal_connect(menu_, "move-current",
+                       G_CALLBACK(OnMenuMoveCurrentThunk), this);
 
   // Block until menu is no longer shown by running a nested message loop.
   MessageLoopForUI::current()->Run(NULL);
@@ -133,7 +133,7 @@ void NativeMenuGtk::RunMenuAt(const gfx::Point& point, int alignment) {
 }
 
 void NativeMenuGtk::CancelMenu() {
-  NOTIMPLEMENTED();
+  gtk_widget_hide(menu_);
 }
 
 void NativeMenuGtk::Rebuild() {
@@ -208,9 +208,8 @@ void NativeMenuGtk::RemoveMenuListener(MenuListener* listener) {
 ////////////////////////////////////////////////////////////////////////////////
 // NativeMenuGtk, private:
 
-// static
-void NativeMenuGtk::OnMenuHidden(GtkWidget* widget, NativeMenuGtk* menu) {
-  if (!menu->menu_shown_) {
+void NativeMenuGtk::OnMenuHidden(GtkWidget* widget) {
+  if (!menu_shown_) {
     // This indicates we don't have a menu open, and should never happen.
     NOTREACHED();
     return;
@@ -219,10 +218,8 @@ void NativeMenuGtk::OnMenuHidden(GtkWidget* widget, NativeMenuGtk* menu) {
   MessageLoop::current()->Quit();
 }
 
-// static
-void NativeMenuGtk::OnMenuMoveCurrent(GtkMenu* menu_widget,
-                                      GtkMenuDirectionType focus_direction,
-                                      NativeMenuGtk* menu) {
+void NativeMenuGtk::OnMenuMoveCurrent(GtkWidget* menu_widget,
+                                      GtkMenuDirectionType focus_direction) {
   GtkWidget* parent = GTK_MENU_SHELL(menu_widget)->parent_menu_shell;
   GtkWidget* menu_item = GTK_MENU_SHELL(menu_widget)->active_menu_item;
   GtkWidget* submenu = NULL;
@@ -231,11 +228,11 @@ void NativeMenuGtk::OnMenuMoveCurrent(GtkMenu* menu_widget,
   }
 
   if (focus_direction == GTK_MENU_DIR_CHILD && submenu == NULL) {
-    menu->GetAncestor()->menu_action_ = MENU_ACTION_NEXT;
-    gtk_menu_popdown(menu_widget);
+    GetAncestor()->menu_action_ = MENU_ACTION_NEXT;
+    gtk_menu_popdown(GTK_MENU(menu_widget));
   } else if (focus_direction == GTK_MENU_DIR_PARENT && parent == NULL) {
-    menu->GetAncestor()->menu_action_ = MENU_ACTION_PREVIOUS;
-    gtk_menu_popdown(menu_widget);
+    GetAncestor()->menu_action_ = MENU_ACTION_PREVIOUS;
+    gtk_menu_popdown(GTK_MENU(menu_widget));
   }
 }
 
diff --git a/views/controls/menu/native_menu_gtk.h b/views/controls/menu/native_menu_gtk.h
index 812fbad..a8ba37c 100644
--- a/views/controls/menu/native_menu_gtk.h
+++ b/views/controls/menu/native_menu_gtk.h
@@ -9,6 +9,7 @@
 
 #include <vector>
 
+#include "app/gtk_signal.h"
 #include "base/task.h"
 #include "views/controls/menu/menu_wrapper.h"
 
@@ -43,10 +44,9 @@ class NativeMenuGtk : public MenuWrapper {
   virtual void RemoveMenuListener(MenuListener* listener);
 
  private:
-  static void OnMenuHidden(GtkWidget* widget, NativeMenuGtk* menu);
-  static void OnMenuMoveCurrent(GtkMenu* widget,
-                                GtkMenuDirectionType focus_direction,
-                                NativeMenuGtk* menu);
+  CHROMEGTK_CALLBACK_0(NativeMenuGtk, void, OnMenuHidden);
+  CHROMEGTK_CALLBACK_1(NativeMenuGtk, void, OnMenuMoveCurrent,
+                       GtkMenuDirectionType);
 
   void AddSeparatorAt(int index);
   GtkWidget* AddMenuItemAt(int index, GtkRadioMenuItem* radio_group,