views: menu: Enforce nested dispatcher destruction ordering

Nested dispatchers must be destroyed in the opposite order they are
installed. We shouldn't restore the dispatcher in QuitNow() if the nested
loop is still running, since another dispatcher might be stacked on top
of it (e.g. drag & drop).

This fixes a regression since r310020 ("views: menu: Remove
MenuMessageLoop::ShouldQuitNow"). Before that change, we explicitly
checked for drag & drop operations, and delayed message loop termination
if one was in progress. Since it now terminates regardless of DnD state,
the dispatcher gets destroyed earlier and (incorrectly) before the DnD
dispatcher is destroyed. Fix this by delaying dispatcher destruction
until our MenuMessageLoop actually returns.

BUG=447098
TEST=interactive_ui_tests

Review URL: https://codereview.chromium.org/809313010

Cr-Commit-Position: refs/heads/master@{#310651}

2 files changed, 2 insertions, 7 deletions

diff --git a/ui/views/controls/menu/menu_message_loop_aura.cc b/ui/views/controls/menu/menu_message_loop_aura.cc
index 72cf2dc..542faa3 100644
--- a/ui/views/controls/menu/menu_message_loop_aura.cc
+++ b/ui/views/controls/menu/menu_message_loop_aura.cc
@@ -156,10 +156,9 @@ void MenuMessageLoopAura::Run(MenuController* controller,
   }
 #else
   internal::MenuEventDispatcher event_dispatcher(controller);
-  scoped_ptr<ui::ScopedEventDispatcher> old_dispatcher =
-      nested_dispatcher_.Pass();
+  scoped_ptr<ui::ScopedEventDispatcher> dispatcher_override;
   if (ui::PlatformEventSource::GetInstance()) {
-    nested_dispatcher_ =
+    dispatcher_override =
         ui::PlatformEventSource::GetInstance()->OverrideDispatcher(
             &event_dispatcher);
   }
@@ -178,15 +177,12 @@ void MenuMessageLoopAura::Run(MenuController* controller,
     message_loop_quit_ = run_loop.QuitClosure();
     run_loop.Run();
   }
-  nested_dispatcher_ = old_dispatcher.Pass();
 #endif
 }
 
 void MenuMessageLoopAura::QuitNow() {
   CHECK(!message_loop_quit_.is_null());
   message_loop_quit_.Run();
-  // Restore the previous dispatcher.
-  nested_dispatcher_.reset();
 }
 
 void MenuMessageLoopAura::ClearOwner() {
diff --git a/ui/views/controls/menu/menu_message_loop_aura.h b/ui/views/controls/menu/menu_message_loop_aura.h
index 865c6a2..80485e9 100644
--- a/ui/views/controls/menu/menu_message_loop_aura.h
+++ b/ui/views/controls/menu/menu_message_loop_aura.h
@@ -40,7 +40,6 @@ class MenuMessageLoopAura : public MenuMessageLoop {
   // WARNING: this may be NULL.
   Widget* owner_;
 
-  scoped_ptr<ui::ScopedEventDispatcher> nested_dispatcher_;
   base::Closure message_loop_quit_;
 
   DISALLOW_COPY_AND_ASSIGN(MenuMessageLoopAura);