Crash in AppMenu::ExecuteCommand

[iefremov]

https://share.backtrace.io/api/share/eFz39M90hc021bF0f9hwH1

[ 00 ] AppMenu::ExecuteCommand(int,int) ( app_menu.cc:1194 )
[ 01 ] BraveAppMenu::ExecuteCommand(int,int) ( brave_app_menu.cc:44 )
[ 02 ] views::internal::MenuRunnerImpl::OnMenuClosed(views::internal::MenuControllerDelegate::NotifyType,views::MenuItemView *,int) ( menu_runner_impl.cc:241 )
[ 03 ] views::MenuController::ExitTopMostMenu() ( menu_controller.cc:3319 )
[ 04 ] views::MenuController::ExitMenu() ( menu_controller.cc:3234 )
[ 05 ] views::MenuController::Accept(views::MenuItemView *,int) ( menu_controller.cc:1917 )
[ 06 ] base::internal::RawPtrBackupRefImpl<0,0>::ReleaseWrappedPtr(views::MenuDelegate *) ( raw_ptr_backup_ref_impl.h:195 )
[ 07 ] base::raw_ptr<views::MenuDelegate,0>::~raw_ptr() ( raw_ptr.h:417 )
[ 08 ] views::MenuItemView::GetDelegate() ( menu_item_view.cc:651 )
[ 09 ] views::MenuController::OnMouseReleased(views::SubmenuView *,ui::MouseEvent const &) ( menu_controller.cc:925 )
[ 10 ] base::internal::RawPtrBackupRefImpl<1,0>::ReleaseWrappedPtr(aura::Window *) ( raw_ptr_backup_ref_impl.h:195 )
[ 11 ] base::raw_ptr<aura::Window,1>::~raw_ptr() ( raw_ptr.h:417 )
[ 12 ] views::corewm::TooltipController::ResetWindowAtMousePressedIfNeeded(aura::Window *,bool) ( tooltip_controller.cc:531 )
[ 13 ] views::TooltipManagerAura::UpdateTooltipForTarget(views::View *,gfx::Point const &,aura::Window *) ( tooltip_manager_aura.cc:159 )
[ 14 ] 0xa326dcb8
[ 15 ] views::Widget::OnMouseEvent(ui::MouseEvent *) ( widget.cc:1797 )
[ 16 ] views::TooltipManagerAura::UpdateTooltipManagerForCapture(views::internal::NativeWidgetPrivate *) ( tooltip_manager_aura.cc:79 )
[ 17 ] __libcpp_operator_delete(void *) ( new:280 )
[ 18 ] __do_deallocate_handle_size(void *,unsigned __int64) ( new:302 )
[ 19 ] __libcpp_deallocate(void *,unsigned __int64,unsigned __int64) ( new:317 )
[ 20 ] std::__Cr::allocator<base::raw_ptr<ui::EventHandler,1> >::deallocate(base::raw_ptr<ui::EventHandler,1> *,unsigned __int64) ( allocator.h:139 )
[ 21 ] std::__Cr::allocator_traits<std::__Cr::allocator<base::raw_ptr<ui::EventHandler,1> > >::deallocate(std::__Cr::allocator<base::raw_ptr<ui::EventHandler,1> > &,base::raw_ptr<ui::EventHandler,1> *,unsigned __int64) ( allocator_traits.h:313 )
[ 22 ] std::__Cr::__split_buffer<base::raw_ptr<ui::EventHandler,1>,std::__Cr::allocator<base::raw_ptr<ui::EventHandler,1> > &>::~__split_buffer() ( __split_buffer:355 )
[ 23 ] std::__Cr::vector<ui::EventTarget::PrioritizedHandler,std::__Cr::allocator<ui::EventTarget::PrioritizedHandler> >::insert(std::__Cr::__wrap_iter<const ui::EventTarget::PrioritizedHandler *>,std::__Cr::__wrap_iter<ui::EventTarget::PrioritizedHandler *>,std::__Cr::__wrap_iter<ui::EventTarget::PrioritizedHandler *>) ( vector:1726 )
[ 24 ] ui::EventTarget::GetPreTargetHandlers(std::__Cr::vector<base::raw_ptr<ui::EventHandler,1>,std::__Cr::allocator<base::raw_ptr<ui::EventHandler,1> > > *) ( event_target.cc:97 )
[ 25 ] ui::EventDispatcher::ProcessEvent(ui::EventTarget *,ui::Event *) ( event_dispatcher.cc:137 )
[ 26 ] ui::EventDispatcherDelegate::DispatchEvent(ui::EventTarget *,ui::Event *) ( event_dispatcher.cc:54 )
[ 27 ] ui::EventProcessor::OnEventFromSource(ui::Event *) ( event_processor.cc:21 )
[ 28 ] ui::EventSource::DeliverEventToSink(ui::Event *) ( event_source.cc:119 )
[ 29 ] ui::EventSource::SendEventToSinkFromRewriter(ui::Event const *,ui::EventRewriter const *) ( event_source.cc:153 )
[ 30 ] ui::EventSource::SendEventToSink(ui::Event const *) ( event_source.cc:113 )
[ 31 ] views::DesktopWindowTreeHostWin::HandleMouseEvent(ui::MouseEvent *) ( desktop_window_tree_host_win.cc:1056 )
[ 32 ] views::HWNDMessageHandler::HandleMouseEventInternal(unsigned int,unsigned __int64,__int64,bool) ( hwnd_message_handler.cc:3280 )

[simonhong]

Crash happened second line of below in AppMenu::ExecuteCommand().
It seems command_id_to_entry_ has entry for command_id.
Not sure but maybe that entry's first(ui::MenuModel*) points dangling pointer?
Is it possible that menu model is destroyed before menu?

  const Entry& entry = command_id_to_entry_.find(command_id)->second;
  return entry.first->ActivatedAt(entry.second, mouse_event_flags);