Fixes possible crash in bookmark menus. Specifically if you had a menu

showing and brought up the context menu and clicked a separator we
would do the wrong thing. We would try to show the first menu again,
without cancelling out of the inner loop, which would most likely
result in a crash. The right thing to do in this case is not close the
context menu (this behavior can be seen in windows as well).

BUG=17862
TEST=see bug, but also covered by ui test now.

Review URL: http://codereview.chromium.org/160458

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@22180 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 10 insertions, 3 deletions

diff --git a/views/controls/menu/chrome_menu.cc b/views/controls/menu/chrome_menu.cc
index f6e3950..1bd7b53 100644
--- a/views/controls/menu/chrome_menu.cc
+++ b/views/controls/menu/chrome_menu.cc
@@ -1790,7 +1790,7 @@ void MenuController::OnMousePressed(SubmenuView* source,
 
   bool open_submenu = false;
   if (!part.menu) {
-    part.menu = source->GetMenuItem();
+    part.menu = part.parent;
     open_submenu = true;
   } else {
     if (part.menu->GetDelegate()->CanDrag(part.menu)) {
@@ -2339,6 +2339,8 @@ bool MenuController::GetMenuPartByScreenCoordinateImpl(
     View::ConvertPointToView(NULL, menu, &menu_loc);
     part->menu = GetMenuItemAt(menu, menu_loc.x(), menu_loc.y());
     part->type = MenuPart::MENU_ITEM;
+    if (!part->menu)
+      part->parent = menu->GetMenuItem();
     return true;
   }
 
diff --git a/views/controls/menu/chrome_menu.h b/views/controls/menu/chrome_menu.h
index e9f6259..89d16d41 100644
--- a/views/controls/menu/chrome_menu.h
+++ b/views/controls/menu/chrome_menu.h
@@ -714,7 +714,7 @@ class MenuController
       SCROLL_DOWN
     };
 
-    MenuPart() : type(NONE), menu(NULL), submenu(NULL) {}
+    MenuPart() : type(NONE), menu(NULL), parent(NULL), submenu(NULL) {}
 
     // Convenience for testing type == SCROLL_DOWN or type == SCROLL_UP.
     bool is_scroll() const { return type == SCROLL_DOWN || type == SCROLL_UP; }
@@ -726,9 +726,14 @@ class MenuController
     // this is NULL.
     // NOTE: if type is MENU_ITEM and the mouse is not over a valid menu item
     //       but is over a menu (for example, the mouse is over a separator or
-    //       empty menu), this is NULL.
+    //       empty menu), this is NULL and parent is the menu the mouse was
+    //       clicked on.
     MenuItemView* menu;
 
+    // If type is MENU_ITEM but the mouse is not over a menu item this is the
+    // parent of the menu item the user clicked on. Otherwise this is NULL.
+    MenuItemView* parent;
+
     // If type is SCROLL_*, this is the submenu the mouse is over.
     SubmenuView* submenu;
   };