Code: void LauncherView::ShowOverflowMenu() {
#if !defined(OS_MACOSX)
  if (!delegate_)
    return;
 
  std::vector<LauncherItem> items;
  GetOverflowItems(&items);
  if (items.empty())
    return;
 
  MenuDelegateImpl menu_delegate;
  ui::SimpleMenuModel menu_model(&menu_delegate);
  for (size_t i = 0; i < items.size(); ++i)
    menu_model.AddItem(static_cast<int>(i), delegate_->GetTitle(items[i]));
  views::MenuModelAdapter menu_adapter(&menu_model);
  overflow_menu_runner_.reset(new views::MenuRunner(menu_adapter.CreateMenu()));
  gfx::Rect bounds(overflow_button_->size());
  gfx::Point origin;
  ConvertPointToScreen(overflow_button_, &origin);
  if (overflow_menu_runner_->RunMenuAt(GetWidget(), NULL,
          gfx::Rect(origin, size()), views::MenuItemView::TOPLEFT, 0) ==
      views::MenuRunner::MENU_DELETED)
    return;
 
   Shell::GetInstance()->UpdateShelfVisibility();
  if (menu_delegate.activated_command_id() == -1)
    return;
  LauncherID activated_id = items[menu_delegate.activated_command_id()].id;
  LauncherItems::const_iterator window_iter = model_->ItemByID(activated_id);
  if (window_iter == model_->items().end())
    return;  // Window was deleted while menu was up.
  delegate_->ItemClicked(*window_iter, ui::EF_NONE);
#endif  // !defined(OS_MACOSX)
 }

Vulnerability Type: DoS Overflow 
CWE ID: CWE-119
Summary: The PDF functionality in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger out-of-bounds write operations.
Commit Message: ash: Add launcher overflow bubble.

- Host a LauncherView in bubble to display overflown items;
- Mouse wheel and two-finger scroll to scroll the LauncherView in bubble in case overflow bubble is overflown;
- Fit bubble when items are added/removed;
- Keep launcher bar on screen when the bubble is shown;

BUG=128054
TEST=Verify launcher overflown items are in a bubble instead of menu.


Review URL: https://chromiumcodereview.appspot.com/10659003

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@146460 0039d316-1c4b-4281-b951-d872f2087c98