Fixes crash in closing menus. There are two issues here:

ui/views/controls/menu/menu_controller.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/views/controls/menu/menu_controller.h"
 
 #include "base/i18n/case_conversion.h"
 #include "base/i18n/rtl.h"
 #include "base/time.h"
 #include "base/utf_string_conversions.h"
@@ skipping 288 matching lines @@
   owner_ = parent;
 
   // Set the selection, which opens the initial menu.
   SetSelection(root, SELECTION_OPEN_SUBMENU | SELECTION_UPDATE_IMMEDIATELY);
 
   if (!blocking_run_) {
     // Start the timer to hide the menu. This is needed as we get no
     // notification when the drag has finished.
     StartCancelAllTimer();
     return NULL;
-  } else if (button) {
+  }
+
+  if (button)
     menu_button_ = button;
-  }
 
   // Make sure Chrome doesn't attempt to shut down while the menu is showing.
   if (ViewsDelegate::views_delegate)
     ViewsDelegate::views_delegate->AddRef();
 
   // We need to turn on nestable tasks as in some situations (pressing alt-f for
   // one) the menus are run from a task. If we don't do this and are invoked
   // from a task none of the tasks we schedule are processed and the menu
   // appears totally broken.
+  message_loop_depth_++;
+  DCHECK_LE(message_loop_depth_, 2);
 #if defined(USE_AURA)
   aura::client::GetDispatcherClient(
       parent->GetNativeWindow()->GetRootWindow())->
           RunWithDispatcher(this, parent->GetNativeWindow(), true);
 #else
   {
     MessageLoopForUI* loop = MessageLoopForUI::current();
     MessageLoop::ScopedNestableTaskAllower allow(loop);
     loop->RunWithDispatcher(this);
   }
 #endif
+  message_loop_depth_--;
 
   if (ViewsDelegate::views_delegate)
     ViewsDelegate::views_delegate->ReleaseRef();
 
   // Close any open menus.
   SetSelection(NULL, SELECTION_UPDATE_IMMEDIATELY | SELECTION_EXIT);
 
   if (nested_menu) {
     DCHECK(!menu_stack_.empty());
     // We're running from within a menu, restore the previous state.
@@ skipping 678 matching lines @@
       drop_target_(NULL),
       drop_position_(MenuDelegate::DROP_UNKNOWN),
       owner_(NULL),
       possible_drag_(false),
       drag_in_progress_(false),
       valid_drop_coordinates_(false),
       last_drop_operation_(MenuDelegate::DROP_UNKNOWN),
       showing_submenu_(false),
       menu_button_(NULL),
       active_mouse_view_(NULL),
-      delegate_(delegate) {
+      delegate_(delegate),
+      message_loop_depth_(0) {
   active_instance_ = this;
 }
 
 MenuController::~MenuController() {
   DCHECK(!showing_);
   if (active_instance_ == this)
     active_instance_ = NULL;
   StopShowTimer();
   StopCancelAllTimer();
 }
@@ skipping 924 matching lines @@
 
   // Reset the active_mouse_view_ before sending mouse capture lost. That way if
   // it calls back to us, we aren't in a weird state.
   View* active_view = active_mouse_view_;
   active_mouse_view_ = NULL;
   active_view->OnMouseCaptureLost();
 }
 
 void MenuController::SetExitType(ExitType type) {
   exit_type_ = type;
-#if defined(USE_AURA)
-  // On aura, closing menu may not trigger next native event, which
-  // is necessary to exit from nested loop (See Dispatch methods).
-  // Send non-op event so that Dispatch method will always be called.
-  // crbug.com/104684.
-  if (exit_type_ == EXIT_ALL || exit_type_ == EXIT_DESTROYED) {
-    owner_->GetNativeView()->GetRootWindow()->PostNativeEvent(
-        ui::CreateNoopEvent());
-  }
-#endif
+  // Exit nested message loops as soon as possible. We do this as
+  // MessageLoop::Dispatcher is only invoked before native events, which means
+  // its entirely possible for a Widget::CloseNow() task to be processed before
+  // the next native message. By using QuitNow() we ensures the nested message
+  // loop returns as soon as possible and avoids having deleted views classes
+  // (such as widgets and rootviews) on the stack when the nested message loop
+  // stops.
+  //
+  // It's safe to invoke QuitNow multiple times, it only effects the current
+  // loop.
+  if (exit_type_ != EXIT_NONE && message_loop_depth_)
+    MessageLoop::current()->QuitNow();
 }
 
 void MenuController::HandleMouseLocation(SubmenuView* source,
                                          const gfx::Point& mouse_location) {
   if (showing_submenu_)
     return;
 
   MenuPart part = GetMenuPart(source, mouse_location);
 
   UpdateScrolling(part);
@@ skipping 11 matching lines @@
              (!pending_state_.item->HasSubmenu() ||
               !pending_state_.item->GetSubmenu()->IsShowing())) {
     // On exit if the user hasn't selected an item with a submenu, move the
     // selection back to the parent menu item.
     SetSelection(pending_state_.item->GetParentMenuItem(),
                  SELECTION_OPEN_SUBMENU);
   }
 }
 
 }  // namespace views