Code:  void ColorChooserDialog::DidCloseDialog(bool chose_color,
                                         SkColor color,
                                         RunState run_state) {
  if (!listener_)
    return;
   EndRun(run_state);
   CopyCustomColors(custom_colors_, g_custom_colors);
  if (chose_color)
    listener_->OnColorChosen(color);
  listener_->OnColorChooserDialogClosed();
 }

Vulnerability Type: DoS 
CWE ID: CWE-399
Summary: Use-after-free vulnerability in the color-chooser dialog in Google Chrome before 30.0.1599.66 on Windows allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to color_chooser_dialog.cc and color_chooser_win.cc in browser/ui/views/.
Commit Message: ColorChooserWin::End should act like the dialog has closed

This is only a problem on Windows.

When the page closes itself while the color chooser dialog is open,
ColorChooserDialog::DidCloseDialog was called after the listener has been destroyed.

ColorChooserWin::End() will not actually close the color chooser dialog (because we can't) but act like it did so we can do the necessary cleanup.

BUG=279263
R=jschuh@chromium.org, pkasting@chromium.org

Review URL: https://codereview.chromium.org/23785003

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@220639 0039d316-1c4b-4281-b951-d872f2087c98