Merge 37438 - Fix Mac crash when page goes away while a popup menu is active....

chrome/browser/renderer_host/render_widget_host_view_mac.mm

Index: chrome/browser/renderer_host/render_widget_host_view_mac.mm
===================================================================
--- chrome/browser/renderer_host/render_widget_host_view_mac.mm	(revision 37439)
+++ chrome/browser/renderer_host/render_widget_host_view_mac.mm	(working copy)
@@ -394,6 +394,13 @@
     const std::vector<WebMenuItem>& items) {
   is_popup_menu_ = true;
 
+  // Retain the Cocoa view for the duration of the pop-up so that it can't
+  // be dealloced if my Destroy() method is called while the pop-up's up
+  // (which would in turn delete me, causing a crash once the -runMenuInView
+  // call returns. That's what was happening in <http://crbug.com/33250>).
+  scoped_nsobject<RenderWidgetHostViewCocoa> retainedCocoaView
+      ([cocoa_view_ retain]);
+
   NSRect view_rect = [cocoa_view_ bounds];
   NSRect parent_rect = [parent_view_ bounds];
   int y_offset = bounds.y() + bounds.height();
@@ -407,11 +414,19 @@
   {
     // Make sure events can be pumped while the menu is up.
     MessageLoop::ScopedNestableTaskAllower allow(MessageLoop::current());
+    // Now run a SYNCHRONOUS NESTED EVENT LOOP until the pop-up is finished.
     [menu_runner runMenuInView:parent_view_
                     withBounds:position
                   initialIndex:selected_item];
   }
 
+  if (!render_widget_host_) {
+    // Bad news -- my Destroy() was called while I was off running the menu.
+    // Return ASAP, and the release of retainedCocoaView will dealloc my NSView,
+    // which will delete me (whew).
+    return;
+  }
+
   int window_num = [[parent_view_ window] windowNumber];
   NSEvent* event =
       webkit_glue::EventWithMenuAction([menu_runner menuItemWasChosen],
@@ -419,9 +434,6 @@
                                        [menu_runner indexOfSelectedItem],
                                        position, view_rect);
 
-  // CHECK()s inserted to diagnose the crash in http://crbug.com/31716
-  // TODO(pamg): Remove when no longer needed.
-  CHECK(render_widget_host_);
   if ([menu_runner menuItemWasChosen]) {
     // Simulate a menu selection event.
     CHECK(cocoa_view_);