From 68b0feea6d6d43ceaa6fe95b65a82302abbafc34 Mon Sep 17 00:00:00 2001
From: Marshall Greenblatt <magreenblatt@gmail.com>
Date: Fri, 4 Apr 2025 13:49:25 -0400
Subject: [PATCH] Fix dangling menu observer on browser destruction

---
 libcef/browser/browser_host_base.cc                 | 13 +++++++++++++
 libcef/browser/browser_host_base.h                  |  5 ++---
 .../browser/chrome/chrome_context_menu_handler.cc   |  4 +++-
 3 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/libcef/browser/browser_host_base.cc b/libcef/browser/browser_host_base.cc
index 6263fbab0..a9220e3dd 100644
--- a/libcef/browser/browser_host_base.cc
+++ b/libcef/browser/browser_host_base.cc
@@ -1420,6 +1420,19 @@ CefDevToolsWindowRunner* CefBrowserHostBase::GetDevToolsWindowRunner() {
   return devtools_window_runner_.get();
 }
 
+void CefBrowserHostBase::set_context_menu_observer(
+    RenderViewContextMenuObserver* observer) {
+  context_menu_observer_ = observer;
+}
+
+void CefBrowserHostBase::clear_context_menu_observer(
+    RenderViewContextMenuObserver* observer) {
+  // Don't clear if a new Observer has already been assigned.
+  if (context_menu_observer_ == observer) {
+    context_menu_observer_ = nullptr;
+  }
+}
+
 views::Widget* CefBrowserHostBase::GetWindowWidget() const {
   CEF_REQUIRE_UIT();
   if (!platform_delegate_) {
diff --git a/libcef/browser/browser_host_base.h b/libcef/browser/browser_host_base.h
index e2be22f79..a0e1c184f 100644
--- a/libcef/browser/browser_host_base.h
+++ b/libcef/browser/browser_host_base.h
@@ -392,9 +392,8 @@ class CefBrowserHostBase : public CefBrowserHost,
   RenderViewContextMenuObserver* context_menu_observer() const {
     return context_menu_observer_;
   }
-  void set_context_menu_observer(RenderViewContextMenuObserver* observer) {
-    context_menu_observer_ = observer;
-  }
+  void set_context_menu_observer(RenderViewContextMenuObserver* observer);
+  void clear_context_menu_observer(RenderViewContextMenuObserver* observer);
 
   // Returns the Widget owner for the browser window. Only used with windowed
   // browsers.
diff --git a/libcef/browser/chrome/chrome_context_menu_handler.cc b/libcef/browser/chrome/chrome_context_menu_handler.cc
index 124b24ab8..5510764b8 100644
--- a/libcef/browser/chrome/chrome_context_menu_handler.cc
+++ b/libcef/browser/chrome/chrome_context_menu_handler.cc
@@ -82,7 +82,8 @@ class CefContextMenuObserver : public RenderViewContextMenuObserver,
                          CefRefPtr<CefBrowserHostBase> browser,
                          CefRefPtr<CefContextMenuHandler> handler)
       : context_menu_(context_menu), browser_(browser), handler_(handler) {
-    // This remains valid until the next time a context menu is created.
+    // Association remains valid until the next time a context menu is created,
+    // or this Observer is destroyed.
     browser_->set_context_menu_observer(this);
   }
 
@@ -163,6 +164,7 @@ class CefContextMenuObserver : public RenderViewContextMenuObserver,
 
     // Clear stored state because this object won't be deleted until a new
     // context menu is created or the associated browser is destroyed.
+    browser_->clear_context_menu_observer(this);
     browser_ = nullptr;
     handler_ = nullptr;
     params_ = nullptr;