Fix crash when notification disappears under popup menu.

chrome/browser/ui/cocoa/notifications/balloon_controller.mm

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/cocoa/notifications/balloon_controller.h"
 
 #include "app/l10n_util.h"
 #include "app/mac/nsimage_cache.h"
 #import "base/mac/cocoa_protocols.h"
 #include "base/mac/mac_util.h"
@@ skipping 103 matching lines @@
 }
 
 - (void) mouseEntered:(NSEvent*)event {
   [[closeButton_ cell] setHighlighted:YES];
 }
 
 - (void) mouseExited:(NSEvent*)event {
   [[closeButton_ cell] setHighlighted:NO];
 }
 
+- (void)closeBalloonNow:(bool)byUser {
+  if (!balloon_)
+    return;
+  [self close];
+  if (htmlContents_.get())
+    htmlContents_->Shutdown();
+  if (balloon_)
+    balloon_->OnClose(byUser);
+  balloon_ = NULL;
+}
+
 - (IBAction)optionsButtonPressed:(id)sender {
+  optionMenuIsActive_ = YES;
   [NSMenu popUpContextMenu:[menuController_ menu]
                  withEvent:[NSApp currentEvent]
                    forView:optionsButton_];
+  optionMenuIsActive_ = NO;
+  if (delayedClose_)
+    [self closeBalloonNow: false]; // always by script.
 }
 
 - (IBAction)permissionRevoked:(id)sender {
   DesktopNotificationService* service =
       balloon_->profile()->GetDesktopNotificationService();
   service->DenyPermission(balloon_->notification().origin_url());
 }
 
 - (IBAction)closeButtonPressed:(id)sender {
   [self closeBalloon:YES];
   [self close];
 }
 
 - (void)close {
   if (closeButtonTrackingTag_)
     [shelf_ removeTrackingRect:closeButtonTrackingTag_];
 
   [super close];
 }
 
 - (void)closeBalloon:(bool)byUser {
-  if (!balloon_)
+  // Keep alive while user is interacting with popup menu.
+  // Otherwise the script can close the notification and underlying balloon
+  // will be destroyed while user select a menu command.
+  if (!byUser && optionMenuIsActive_) {
+    delayedClose_ = YES;
     return;
-  [self close];
-  if (htmlContents_.get())
-    htmlContents_->Shutdown();
-  if (balloon_)
-    balloon_->OnClose(byUser);
-  balloon_ = NULL;
+  }
+  [self closeBalloonNow: byUser];
 }
 
 - (void)updateContents {
   DCHECK(htmlContents_.get()) << "BalloonView::Update called before Show";
   if (htmlContents_->render_view_host())
     htmlContents_->render_view_host()->NavigateToURL(
         balloon_->notification().content_url());
 }
 
 - (void)repositionToBalloon {
@@ skipping 32 matching lines @@
   htmlContents_.reset(new BalloonViewHost(balloon_));
   htmlContents_->Init();
 }
 
 // NSWindowDelegate notification.
 - (void)windowWillClose:(NSNotification*)notif {
   [self autorelease];
 }
 
 @end