Make the HistoryMenuBridge::HistoryItem co-own the NSMenuItem. This hopefully fixes a top-crash.

chrome/browser/cocoa/history_menu_bridge.mm

Index: chrome/browser/cocoa/history_menu_bridge.mm
diff --git a/chrome/browser/cocoa/history_menu_bridge.mm b/chrome/browser/cocoa/history_menu_bridge.mm
index 093ab4075612b52a5ae3ae2cc3436851b742bbf5..fb40e9b5d2fdcdf4d6267116c9a6f5c801e8d89d 100644
--- a/chrome/browser/cocoa/history_menu_bridge.mm
+++ b/chrome/browser/cocoa/history_menu_bridge.mm
@@ -298,28 +298,27 @@ NSMenuItem* HistoryMenuBridge::AddItemToMenu(HistoryItem* item,
                [title substringFromIndex:([title length] -
                                           kMenuTrimSizeInChars)]];
   }
-  scoped_nsobject<NSMenuItem> menu_item(

[John Grabowski, 2010/06/17 18:53:55]

Perhaps there is an easier solution?
If you just do an autorelease/retain of this menu item, the item's lifetime will
probably be correct.

Can you try that out?

[Robert Sesek, 2010/06/17 19:05:44]

I tried that as well as nil-ing the item in ClearMenuSection().  It happened
less frequently (or maybe I just didn't repro correctly), but it still happened.
 I think this solution is both safer and technically correct, and it makes
memory ownership explicitly clear.

+  item->menu_item.reset(
       [[NSMenuItem alloc] initWithTitle:title
                                  action:nil
                           keyEquivalent:@""]);
-  [menu_item setTarget:controller_];
-  [menu_item setAction:@selector(openHistoryMenuItem:)];
-  [menu_item setTag:tag];
+  [item->menu_item setTarget:controller_];
+  [item->menu_item setAction:@selector(openHistoryMenuItem:)];
+  [item->menu_item setTag:tag];
   if (item->icon.get())
-    [menu_item setImage:item->icon.get()];
+    [item->menu_item setImage:item->icon.get()];
   else if (!item->tabs.size())
-    [menu_item setImage:default_favicon_.get()];
+    [item->menu_item setImage:default_favicon_.get()];
 
   // Add a tooltip.
   NSString* tooltip = [NSString stringWithFormat:@"%@\n%s", full_title,
                                 url_string.c_str()];
-  [menu_item setToolTip:tooltip];
+  [item->menu_item setToolTip:tooltip];
 
-  [menu insertItem:menu_item atIndex:index];
-  item->menu_item = menu_item.get();
-  menu_item_map_.insert(std::make_pair(menu_item.get(), item));
+  [menu insertItem:item->menu_item.get() atIndex:index];
+  menu_item_map_.insert(std::make_pair(item->menu_item.get(), item));
 
-  return menu_item;
+  return item->menu_item.get();
 }
 
 void HistoryMenuBridge::Init() {