app_list: Fix UAF after menu close.

App list now uses ui::SimpleMenuModel created in chrome directly.
The SimpleMenuModel uses AppContextMenu as its delegate and its
life time is bound to ChromeAppListItem and ChromeSearchResult,
which is different with the UI associated with them. When menu
is dismissed, it schedules SimpleMenuModel::OnMenuClosed() call
and could be reached after chrome side AppContextMenu is released.

The CL wire up OnMenuClosed in the UI elements to releases the
menu model. This happens before chrome releasing AppContextMenu
on dismissing app list.

Bug: 965848
Test: Select "App Info" on context menu of SearchResultTileItemView.
Change-Id: I56dfbb0551c336b31326297ca01eab6e166529bc
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1625649Reviewed-by: Xiyuan Xia <xiyuan@chromium.org>
Reviewed-by: Alex Newcomer <newcomer@chromium.org>
Commit-Queue: Xiyuan Xia <xiyuan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#662277}

ash/app_list/views/app_list_item_view.cc

@@ -784,6 +784,10 @@ void AppListItemView::AnimationProgressed(const gfx::Animation* animation) {
 }
 
 void AppListItemView::OnMenuClosed() {
+  // Release menu since its menu model delegate (AppContextMenu) could be
+  // released as a result of menu command execution.
+  context_menu_.reset();
+
   if (!menu_close_initiated_from_drag_) {
     // If the menu was not closed due to a drag sequence(e.g. multi touch) reset
     // the drag state.

ash/app_list/views/search_result_tile_item_view.cc

@@ -382,6 +382,9 @@ void SearchResultTileItemView::OnGetContextMenuModel(
 }
 
 void SearchResultTileItemView::OnMenuClosed() {
+  // Release menu since its menu model delegate (AppContextMenu) could be
+  // released as a result of menu command execution.
+  context_menu_.reset();
   OnBlur();
 }
 

ash/app_list/views/search_result_view.cc

@@ -436,6 +436,12 @@ bool SearchResultView::IsSearchResultHoveredOrSelected() {
   return IsMouseHovered() || selected();
 }
 
+void SearchResultView::OnMenuClosed() {
+  // Release menu since its menu model delegate (AppContextMenu) could be
+  // released as a result of menu command execution.
+  context_menu_.reset();
+}
+
 void SearchResultView::ShowContextMenuForViewImpl(
     views::View* source,
     const gfx::Point& point,
@@ -455,7 +461,7 @@ void SearchResultView::OnGetContextMenu(
     const gfx::Point& point,
     ui::MenuSourceType source_type,
     std::unique_ptr<ui::SimpleMenuModel> menu_model) {
-  if (!menu_model || context_menu_->IsShowingMenu())
+  if (!menu_model || (context_menu_ && context_menu_->IsShowingMenu()))
     return;
 
   AppLaunchedMetricParams metric_params = {
@@ -466,7 +472,9 @@ void SearchResultView::OnGetContextMenu(
   context_menu_ = std::make_unique<AppListMenuModelAdapter>(
       std::string(), std::move(menu_model), GetWidget(), source_type,
       metric_params, AppListMenuModelAdapter::SEARCH_RESULT,
-      base::OnceClosure(), view_delegate_->GetSearchModel()->tablet_mode());
+      base::BindOnce(&SearchResultView::OnMenuClosed,
+                     weak_ptr_factory_.GetWeakPtr()),
+      view_delegate_->GetSearchModel()->tablet_mode());
   context_menu_->Run(gfx::Rect(point, gfx::Size()),
                      views::MenuAnchorPosition::kTopLeft,
                      views::MenuRunner::HAS_MNEMONICS);

ash/app_list/views/search_result_view.h

@@ -113,6 +113,9 @@ class APP_LIST_EXPORT SearchResultView
   void OnSearchResultActionActivated(size_t index, int event_flags) override;
   bool IsSearchResultHoveredOrSelected() override;
 
+  // Invoked when the context menu closes.
+  void OnMenuClosed();
+
   // Parent list view. Owned by views hierarchy.
   SearchResultListView* list_view_;