Fix Mac crash when page goes away while a pop-up menu is active.

chrome/browser/renderer_host/render_widget_host_view_mac.mm

Index: chrome/browser/renderer_host/render_widget_host_view_mac.mm
diff --git a/chrome/browser/renderer_host/render_widget_host_view_mac.mm b/chrome/browser/renderer_host/render_widget_host_view_mac.mm
index 9eb46a8d3fd3b1fbdb071397be5da66f39cd2b6e..c3f338bf50bf7380d62eea1d685cf65c3ed04e6e 100644
--- a/chrome/browser/renderer_host/render_widget_host_view_mac.mm
+++ b/chrome/browser/renderer_host/render_widget_host_view_mac.mm
@@ -394,6 +394,13 @@ void RenderWidgetHostViewMac::ShowPopupWithItems(
     const std::vector<WebMenuItem>& items) {
   is_popup_menu_ = true;
 
+  // Retain the Cocoa view for the duration of the pop-up so that it can't
+  // be dealloced if my Destroy() method is called while the pop-up's up
+  // (which would in turn delete me, causing a crash once the -runMenuInView
+  // call returns. That's what was happening in <http://crbug.com/33250>).
+  scoped_nsobject<RenderWidgetHostViewCocoa> retainedCocoaView
+      ([cocoa_view_ retain]);

[Scott Hess - ex-Googler, 2010/01/28 19:02:13]

None of the code in question references cocoa_view_, I think you would want to
retain parent_view_.

+
   NSRect view_rect = [cocoa_view_ bounds];
   NSRect parent_rect = [parent_view_ bounds];
   int y_offset = bounds.y() + bounds.height();
@@ -407,11 +414,19 @@ void RenderWidgetHostViewMac::ShowPopupWithItems(
   {
     // Make sure events can be pumped while the menu is up.
     MessageLoop::ScopedNestableTaskAllower allow(MessageLoop::current());
+    // Now run a SYNCHRONOUS NESTED EVENT LOOP until the pop-up is finished.
     [menu_runner runMenuInView:parent_view_
                     withBounds:position
                   initialIndex:selected_item];
   }
 
+  if (!render_widget_host_) {

[Scott Hess - ex-Googler, 2010/01/28 19:02:13]

It is not safe to access any member variables at this point.  The instance could
have been reallocated.  As I mentioned on the bug, I think you should use a
scoped method factory, which is designed for exactly this type of thing.

+    // Bad news -- my Destroy() was called while I was off running the menu.
+    // Return ASAP, and the release of retainedCocoaView will dealloc my NSView,
+    // which will delete me (whew).
+    return;
+  }
+
   int window_num = [[parent_view_ window] windowNumber];
   NSEvent* event =
       webkit_glue::EventWithMenuAction([menu_runner menuItemWasChosen],
@@ -419,9 +434,6 @@ void RenderWidgetHostViewMac::ShowPopupWithItems(
                                        [menu_runner indexOfSelectedItem],
                                        position, view_rect);
 
-  // CHECK()s inserted to diagnose the crash in http://crbug.com/31716
-  // TODO(pamg): Remove when no longer needed.
-  CHECK(render_widget_host_);
   if ([menu_runner menuItemWasChosen]) {
     // Simulate a menu selection event.
     CHECK(cocoa_view_);