Speculative fix for a crash and tweak to

menus. MenuButton::OnKeyPressed may run a nested message loop, which
means by the time it returns 'this' may have been deleted (a couple of
crashes seem to indicate this). In talking with Domnic the code after
the call to Activate isn't necessary, so I'm removing it.

I'm also changing the cancel call in MenuRunner to supply
EXIT_DESTROYED, which means the menu code won't attempt to touch the
button that was supplied to run. This is necessary as if MenuRunner is
deleted the chances are the button supplied to it has also been
deleted.

BUG=none
TEST=none
R=ben@chromium.org

Review URL: http://codereview.chromium.org/7890073

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@101500 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 5 insertions, 1 deletions

diff --git a/views/controls/menu/menu_runner.cc b/views/controls/menu/menu_runner.cc
index 89cb114..169be0b 100644
--- a/views/controls/menu/menu_runner.cc
+++ b/views/controls/menu/menu_runner.cc
@@ -112,7 +112,11 @@ void MenuRunnerImpl::Release() {
       empty_delegate_.reset(new MenuDelegate());
     menu_->set_delegate(empty_delegate_.get());
 
-    menu_->Cancel();
+    DCHECK(controller_);
+    // Release is invoked when MenuRunner is destroyed. Assume this is happening
+    // because the object referencing the menu has been destroyed and the menu
+    // button is no longer valid.
+    controller_->Cancel(MenuController::EXIT_DESTROYED);
   } else {
     delete this;
   }