Fix use-after-free in BrowserActionOverflowMenuController

When BrowserActionOverflowMenuController is deleted, it deletes its associated
IconUpdaters. When these go away, they remove themselves as the observer on the
associated BrowserActionViews. This led to the use-after-free if the
BrowserActionOverflowMenuController outlasts any of the BrowserActionViews.

BUG=391061

Review URL: https://codereview.chromium.org/379483003

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@282224 0039d316-1c4b-4281-b951-d872f2087c98

chrome/browser/ui/views/extensions/browser_action_overflow_menu_controller.cc

@@ -30,8 +30,7 @@
 // action button's icon has been updated.
 class IconUpdater : public BrowserActionButton::IconObserver {
  public:
-  IconUpdater(views::MenuItemView* menu_item_view,
-              BrowserActionButton* button)
+  IconUpdater(views::MenuItemView* menu_item_view, BrowserActionButton* button)
       : menu_item_view_(menu_item_view),
         button_(button) {
     DCHECK(menu_item_view);
@@ -128,6 +127,10 @@ void BrowserActionOverflowMenuController::CancelMenu() {
   menu_->Cancel();
 }
 
+void BrowserActionOverflowMenuController::NotifyBrowserActionViewsDeleting() {
+  icon_updaters_.clear();
+}
+
 bool BrowserActionOverflowMenuController::IsCommandEnabled(int id) const {
   BrowserActionView* view = (*views_)[start_index_ + id - 1];
   return view->button()->IsEnabled(owner_->GetCurrentTabId());

chrome/browser/ui/views/extensions/browser_action_overflow_menu_controller.h

@@ -51,6 +51,9 @@ class BrowserActionOverflowMenuController : public views::MenuDelegate {
   // Closes the overflow menu (and its context menu if open as well).
   void CancelMenu();
 
+  // Notify the menu that the associated BrowserActionViews have been deleted.
+  void NotifyBrowserActionViewsDeleting();
+
   // Overridden from views::MenuDelegate:
   virtual bool IsCommandEnabled(int id) const OVERRIDE;
   virtual void ExecuteCommand(int id) OVERRIDE;

chrome/browser/ui/views/toolbar/browser_actions_container.cc

@@ -236,6 +236,8 @@ void BrowserActionsContainer::CreateBrowserActionViews() {
 
 void BrowserActionsContainer::DeleteBrowserActionViews() {
   HidePopup();
+  if (overflow_menu_)
+    overflow_menu_->NotifyBrowserActionViewsDeleting();
   STLDeleteElements(&browser_action_views_);
 }