Fix dangling menu observer on browser destruction

libcef/browser/browser_host_base.cc

@@ -1420,6 +1420,19 @@ CefDevToolsWindowRunner* CefBrowserHostBase::GetDevToolsWindowRunner() {
   return devtools_window_runner_.get();
 }
 
+void CefBrowserHostBase::set_context_menu_observer(
+    RenderViewContextMenuObserver* observer) {
+  context_menu_observer_ = observer;
+}
+
+void CefBrowserHostBase::clear_context_menu_observer(
+    RenderViewContextMenuObserver* observer) {
+  // Don't clear if a new Observer has already been assigned.
+  if (context_menu_observer_ == observer) {
+    context_menu_observer_ = nullptr;
+  }
+}
+
 views::Widget* CefBrowserHostBase::GetWindowWidget() const {
   CEF_REQUIRE_UIT();
   if (!platform_delegate_) {

libcef/browser/browser_host_base.h

@@ -392,9 +392,8 @@ class CefBrowserHostBase : public CefBrowserHost,
   RenderViewContextMenuObserver* context_menu_observer() const {
     return context_menu_observer_;
   }
-  void set_context_menu_observer(RenderViewContextMenuObserver* observer) {
-    context_menu_observer_ = observer;
-  }
+  void set_context_menu_observer(RenderViewContextMenuObserver* observer);
+  void clear_context_menu_observer(RenderViewContextMenuObserver* observer);
 
   // Returns the Widget owner for the browser window. Only used with windowed
   // browsers.

libcef/browser/chrome/chrome_context_menu_handler.cc

@@ -82,7 +82,8 @@ class CefContextMenuObserver : public RenderViewContextMenuObserver,
                          CefRefPtr<CefBrowserHostBase> browser,
                          CefRefPtr<CefContextMenuHandler> handler)
       : context_menu_(context_menu), browser_(browser), handler_(handler) {
-    // This remains valid until the next time a context menu is created.
+    // Association remains valid until the next time a context menu is created,
+    // or this Observer is destroyed.
     browser_->set_context_menu_observer(this);
   }
 
@@ -163,6 +164,7 @@ class CefContextMenuObserver : public RenderViewContextMenuObserver,
 
     // Clear stored state because this object won't be deleted until a new
     // context menu is created or the associated browser is destroyed.
+    browser_->clear_context_menu_observer(this);
     browser_ = nullptr;
     handler_ = nullptr;
     params_ = nullptr;