Make the HistoryMenuBridge::HistoryItem co-own the NSMenuItem. This hopefully fixes a top-crash.

chrome/browser/cocoa/history_menu_bridge.h

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_COCOA_HISTORY_MENU_BRIDGE_H_
 #define CHROME_BROWSER_COCOA_HISTORY_MENU_BRIDGE_H_
 
 #import <Cocoa/Cocoa.h>
 #include <map>
 
@@ skipping 70 matching lines @@
     // Favicon for the URL.
     scoped_nsobject<NSImage> icon;
 
     // If the icon is being requested from the FaviconService, |icon_requested|
     // will be true and |icon_handle| will be non-NULL. If this is false, then
     // |icon_handle| will be NULL.
     bool icon_requested;
     // The Handle given to us by the FaviconService for the icon fetch request.
     FaviconService::Handle icon_handle;
 
-    // The pointer to the item after it has been created. Weak.
-    NSMenuItem* menu_item;
+    // The pointer to the item after it has been created. This is co-owned with
+    // the NSMenu, but during a rebuild flood (if the user closes a lot of tabs

[John Grabowski, 2010/06/17 19:30:44]

This is co-owned with the NSMenu.  but ...
-->
Strong; NSMenu also retains this.  during a rebuild flood, ... 

+    // quickly), the NSMenu can release the item before the HistoryItem has
+    // been fully deleted. If this were a weak pointer, it would result in a
+    // zombie.
+    scoped_nsobject<NSMenuItem> menu_item;
 
     // This ID is unique for a browser session and can be passed to the
     // TabRestoreService to re-open the closed window or tab that this
     // references. A non-0 session ID indicates that this is an entry can be
     // restored that way. Otherwise, the URL will be used to open the item and
     // this ID will be 0.
     SessionID::id_type session_id;
 
     // If the HistoryItem is a window, this will be the vector of tabs. Note
     // that this is a list of weak references. The |menu_item_map_| is the owner
@@ skipping 123 matching lines @@
   bool create_in_progress_;
   bool need_recreate_;
 
   // The default favicon if a HistoryItem does not have one.
   scoped_nsobject<NSImage> default_favicon_;
 
   DISALLOW_COPY_AND_ASSIGN(HistoryMenuBridge);
 };
 
 #endif  // CHROME_BROWSER_COCOA_HISTORY_MENU_BRIDGE_H_