Rework a loop in the native menu code to iterate over the vector of items we have, rather than the actual system menu.

I believe this may fix a crash where the code indexes out of bounds in the vector. The trouble is the assumption that the native menu index matches the index into the vector. If someone has installed a windows addon this may not be true. It's safer to restrict the iteration to the bounds of the vector and index into the menu based on that.

http://crbug.com/14600
TEST=none

Review URL: http://codereview.chromium.org/150061

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@19558 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 5 insertions, 4 deletions

diff --git a/views/controls/menu/native_menu_win.cc b/views/controls/menu/native_menu_win.cc
index 3ef158c..8de7621 100644
--- a/views/controls/menu/native_menu_win.cc
+++ b/views/controls/menu/native_menu_win.cc
@@ -346,16 +346,17 @@ void NativeMenuWin::Rebuild() {
 
 void NativeMenuWin::UpdateStates() {
   // A depth-first walk of the menu items, updating states.
-  for (int menu_index = first_item_index_;
-       menu_index < first_item_index_ + model_->GetItemCount(); ++menu_index) {
-    int model_index = menu_index - first_item_index_;
+  int model_index = 0;
+  std::vector<ItemData*>::const_iterator it;
+  for (it = items_.begin(); it != items_.end(); ++it, ++model_index) {
+    int menu_index = model_index + first_item_index_;
     SetMenuItemState(menu_index, model_->IsEnabledAt(model_index),
                      model_->IsItemCheckedAt(model_index), false);
     if (model_->IsLabelDynamicAt(model_index)) {
       SetMenuItemLabel(menu_index, model_index,
                        model_->GetLabelAt(model_index));
     }
-    Menu2* submenu = items_[model_index]->submenu.get();
+    Menu2* submenu = (*it)->submenu.get();
     if (submenu)
       submenu->UpdateStates();
   }