Merge 37438 - Fix Mac crash when page goes away while a popup menu is active....

chrome/browser/renderer_host/render_widget_host_view_mac.mm

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/renderer_host/render_widget_host_view_mac.h"
 
 #include "base/histogram.h"
 #import "base/scoped_nsobject.h"
 #include "base/string_util.h"
 #include "base/sys_string_conversions.h"
@@ skipping 376 matching lines @@
 }
 
 // Display a popup menu for WebKit using Cocoa widgets.
 void RenderWidgetHostViewMac::ShowPopupWithItems(
     gfx::Rect bounds,
     int item_height,
     int selected_item,
     const std::vector<WebMenuItem>& items) {
   is_popup_menu_ = true;
 
+  // Retain the Cocoa view for the duration of the pop-up so that it can't
+  // be dealloced if my Destroy() method is called while the pop-up's up
+  // (which would in turn delete me, causing a crash once the -runMenuInView
+  // call returns. That's what was happening in <http://crbug.com/33250>).
+  scoped_nsobject<RenderWidgetHostViewCocoa> retainedCocoaView
+      ([cocoa_view_ retain]);
+
   NSRect view_rect = [cocoa_view_ bounds];
   NSRect parent_rect = [parent_view_ bounds];
   int y_offset = bounds.y() + bounds.height();
   NSRect position = NSMakeRect(bounds.x(), parent_rect.size.height - y_offset,
                                bounds.width(), bounds.height());
 
   // Display the menu.
   scoped_nsobject<WebMenuRunner> menu_runner;
   menu_runner.reset([[WebMenuRunner alloc] initWithItems:items]);
 
   {
     // Make sure events can be pumped while the menu is up.
     MessageLoop::ScopedNestableTaskAllower allow(MessageLoop::current());
+    // Now run a SYNCHRONOUS NESTED EVENT LOOP until the pop-up is finished.
     [menu_runner runMenuInView:parent_view_
                     withBounds:position
                   initialIndex:selected_item];
   }
 
+  if (!render_widget_host_) {
+    // Bad news -- my Destroy() was called while I was off running the menu.
+    // Return ASAP, and the release of retainedCocoaView will dealloc my NSView,
+    // which will delete me (whew).
+    return;
+  }
+
   int window_num = [[parent_view_ window] windowNumber];
   NSEvent* event =
       webkit_glue::EventWithMenuAction([menu_runner menuItemWasChosen],
                                        window_num, item_height,
                                        [menu_runner indexOfSelectedItem],
                                        position, view_rect);
 
-  // CHECK()s inserted to diagnose the crash in http://crbug.com/31716
-  // TODO(pamg): Remove when no longer needed.
-  CHECK(render_widget_host_);
   if ([menu_runner menuItemWasChosen]) {
     // Simulate a menu selection event.
     CHECK(cocoa_view_);
     const WebMouseEvent& mouse_event =
         WebInputEventFactory::mouseEvent(event, cocoa_view_);
     render_widget_host_->ForwardMouseEvent(mouse_event);
   } else {
     // Simulate a menu dismiss event.
     NativeWebKeyboardEvent keyboard_event(event);
     render_widget_host_->ForwardKeyboardEvent(keyboard_event);
@@ skipping 962 matching lines @@
     event.skip_in_browser = true;
     renderWidgetHostView_->render_widget_host_->ForwardKeyboardEvent(event);
   } else {
     renderWidgetHostView_->render_widget_host_->ImeConfirmComposition(
         UTF8ToUTF16([im_text UTF8String]));
   }
   renderWidgetHostView_->im_composing_ = false;
 }
 
 @end