Fix a crash canceling a completed, auto-opened download.

To reproduce this crash:
1. Set 'Always open files of this type' on the download shelf
   menu to checked for a particular file type.
2. Download a large file of that type.
3. Before the download completes, open its context menu on
   the shelf.
4. When the download completes, select 'Cancel' from the menu.
5. Crash.

The crash occurs because auto-opened downloads automatically
remove (and thus delete) themselves from the shelf even if
the menu is still running. Selecting a menu item at this point
will attempt to access the deleted object.

The fix is to let the menu know when the calling object is
becoming invalid, so we can avoid doing any further work.

BUG=20810
TEST=Try the above repro steps and notice that Chrome doesn't crash.

Review URL: http://codereview.chromium.org/213018

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@26589 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 4 insertions, 0 deletions

diff --git a/chrome/browser/views/download_item_view.h b/chrome/browser/views/download_item_view.h
index 229dab8..f773931 100644
--- a/chrome/browser/views/download_item_view.h
+++ b/chrome/browser/views/download_item_view.h
@@ -38,6 +38,7 @@ class NativeButton;
 class BaseDownloadItemModel;
 class DownloadShelfView;
 class SkBitmap;
+class DownloadShelfContextMenuWin;
 
 class DownloadItemView : public views::ButtonListener,
                          public views::View,
@@ -244,6 +245,9 @@ class DownloadItemView : public views::ButtonListener,
   // downloaded file.
   ScopedRunnableMethodFactory<DownloadItemView> reenable_method_factory_;
 
+  // The currently running download context menu.
+  DownloadShelfContextMenuWin* active_menu_;
+
   DISALLOW_COPY_AND_ASSIGN(DownloadItemView);
 };