[Mac] Fix use-after-free when dragging tabs with page-actions....

chrome/browser/cocoa/location_bar_view_mac.mm

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "chrome/browser/cocoa/location_bar_view_mac.h"
 
 #include "app/l10n_util_mac.h"
 #include "app/resource_bundle.h"
 #include "base/stl_util-inl.h"
 #include "base/string_util.h"
@@ skipping 88 matching lines @@
   AutocompleteTextFieldCell* cell = [field_ autocompleteTextFieldCell];
   [cell setSecurityImageView:&security_image_view_];
   [cell setPageActionViewList:page_action_views_];
 
   registrar_.Add(this,
       NotificationType::EXTENSION_PAGE_ACTION_VISIBILITY_CHANGED,
       NotificationService::AllSources());
 }
 
 LocationBarViewMac::~LocationBarViewMac() {
+  // Disconnect from cell in case it outlives us.
+  AutocompleteTextFieldCell* cell = [field_ autocompleteTextFieldCell];
+  [cell setPageActionViewList:NULL];
+  [cell setSecurityImageView:NULL];
+
   // TODO(shess): Placeholder for omnibox changes.
   delete page_action_views_;
 }
 
 std::wstring LocationBarViewMac::GetInputString() const {
   return location_input_;
 }
 
 WindowOpenDisposition LocationBarViewMac::GetWindowOpenDisposition() const {
   return disposition_;
@@ skipping 633 matching lines @@
     if (views_[i]->IsVisible())
       ++result;
   }
   return result;
 }
 
 void LocationBarViewMac::PageActionViewList::OnMousePressed(NSRect iconFrame,
                                                             size_t index) {
   ViewAt(index)->OnMousePressed(iconFrame);
 }