Make the HistoryMenuBridge::HistoryItem co-own the NSMenuItem. This hopefully fixes a top-crash.

chrome/browser/cocoa/history_menu_bridge.mm

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/cocoa/history_menu_bridge.h"
 
 #include "app/l10n_util.h"
 #include "app/resource_bundle.h"
 #include "base/callback.h"
 #include "base/stl_util-inl.h"
@@ skipping 280 matching lines @@
     title = base::SysUTF8ToNSString(url_string);
   NSString* full_title = title;
   if ([title length] > kMaximumMenuWidthInChars) {
     // TODO(rsesek): use app/text_elider.h once it uses string16 and can
     // take out the middle of strings.
     title = [NSString stringWithFormat:@"%@…%@",
                [title substringToIndex:kMenuTrimSizeInChars],
                [title substringFromIndex:([title length] -
                                           kMenuTrimSizeInChars)]];
   }
-  scoped_nsobject<NSMenuItem> menu_item(

[John Grabowski, 2010/06/17 18:53:55]

Perhaps there is an easier solution?
If you just do an autorelease/retain of this menu item, the item's lifetime will
probably be correct.

Can you try that out?

[Robert Sesek, 2010/06/17 19:05:44]

I tried that as well as nil-ing the item in ClearMenuSection().  It happened
less frequently (or maybe I just didn't repro correctly), but it still happened.
 I think this solution is both safer and technically correct, and it makes
memory ownership explicitly clear.

+  item->menu_item.reset(
       [[NSMenuItem alloc] initWithTitle:title
                                  action:nil
                           keyEquivalent:@""]);
-  [menu_item setTarget:controller_];
-  [menu_item setAction:@selector(openHistoryMenuItem:)];
-  [menu_item setTag:tag];
+  [item->menu_item setTarget:controller_];
+  [item->menu_item setAction:@selector(openHistoryMenuItem:)];
+  [item->menu_item setTag:tag];
   if (item->icon.get())
-    [menu_item setImage:item->icon.get()];
+    [item->menu_item setImage:item->icon.get()];
   else if (!item->tabs.size())
-    [menu_item setImage:default_favicon_.get()];
+    [item->menu_item setImage:default_favicon_.get()];
 
   // Add a tooltip.
   NSString* tooltip = [NSString stringWithFormat:@"%@\n%s", full_title,
                                 url_string.c_str()];
-  [menu_item setToolTip:tooltip];
+  [item->menu_item setToolTip:tooltip];
 
-  [menu insertItem:menu_item atIndex:index];
-  item->menu_item = menu_item.get();
-  menu_item_map_.insert(std::make_pair(menu_item.get(), item));
+  [menu insertItem:item->menu_item.get() atIndex:index];
+  menu_item_map_.insert(std::make_pair(item->menu_item.get(), item));
 
-  return menu_item;
+  return item->menu_item.get();
 }
 
 void HistoryMenuBridge::Init() {
   const NotificationSource& source = NotificationService::AllSources();
   registrar_.Add(this, NotificationType::HISTORY_TYPED_URLS_MODIFIED, source);
   registrar_.Add(this, NotificationType::HISTORY_URL_VISITED, source);
   registrar_.Add(this, NotificationType::HISTORY_URLS_DELETED, source);
 }
 
 void HistoryMenuBridge::CreateMenu() {
@@ skipping 105 matching lines @@
 void HistoryMenuBridge::CancelFaviconRequest(HistoryItem* item) {
   DCHECK(item);
   if (item->icon_requested) {
     FaviconService* service =
         profile_->GetFaviconService(Profile::EXPLICIT_ACCESS);
     service->CancelRequest(item->icon_handle);
     item->icon_requested = false;
     item->icon_handle = NULL;
   }
 }