Fix crash on fullscreening of popup.

BUG=http://crbug.com/18551

TEST=Create a pop-up window.
Fullscreen it (Cmd-Shift-F).
Go back (Cmd-Shift-F again).
Repeat a few times across different launches of Chromium.

Review URL: http://codereview.chromium.org/164024

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@22712 0039d316-1c4b-4281-b951-d872f2087c98

3 files changed, 22 insertions, 0 deletions

diff --git a/chrome/browser/cocoa/toolbar_controller.h b/chrome/browser/cocoa/toolbar_controller.h
index 73891ec..07ec3e7 100644
--- a/chrome/browser/cocoa/toolbar_controller.h
+++ b/chrome/browser/cocoa/toolbar_controller.h
@@ -50,6 +50,10 @@ class ToolbarView;
   BooleanPrefMember showPageOptionButtons_;
   BOOL hasToolbar_;  // if NO, we only have the location bar.
 
+  // We have an extra retain in the locationBar_.
+  // See comments in awakeFromNib for more info.
+  scoped_nsobject<AutocompleteTextField> locationBarRetainer_;
+
   IBOutlet NSMenu* pageMenu_;
   IBOutlet NSMenu* wrenchMenu_;
 
diff --git a/chrome/browser/cocoa/toolbar_controller.mm b/chrome/browser/cocoa/toolbar_controller.mm
index de9b9a0..b5bc147 100644
--- a/chrome/browser/cocoa/toolbar_controller.mm
+++ b/chrome/browser/cocoa/toolbar_controller.mm
@@ -119,6 +119,16 @@ class PrefObserverBridge : public NotificationObserver {
   // bottom-aligned to it's parent view (among other things), so
   // position and resize properties don't need to be set.
   [[self view] addSubview:[bookmarkBarController_ view]];
+
+  // For a popup window, the toolbar is really just a location bar
+  // (see override for [ToolbarController view], below).  When going
+  // fullscreen, we remove the toolbar controller's view from the view
+  // hierarchy.  Calling [locationBar_ removeFromSuperview] when going
+  // fullscreen causes it to get released, making us unhappy
+  // (http://crbug.com/18551).  We avoid the problem by incrementing
+  // the retain count of the location bar; use of the scoped object
+  // helps us remember to release it.
+  locationBarRetainer_.reset([locationBar_ retain]);
 }
 
 - (LocationBar*)locationBar {
diff --git a/chrome/browser/cocoa/toolbar_controller_unittest.mm b/chrome/browser/cocoa/toolbar_controller_unittest.mm
index a3a7649..9690c5b 100644
--- a/chrome/browser/cocoa/toolbar_controller_unittest.mm
+++ b/chrome/browser/cocoa/toolbar_controller_unittest.mm
@@ -84,6 +84,14 @@ TEST_F(ToolbarControllerTest, TitlebarOnly) {
   EXPECT_NE(view, [bar_ view]);
   EXPECT_FALSE([bar_ bookmarkBarController]);
 
+  // Simulate a popup going fullscreen and back.
+  NSView* superview = [view superview];
+  // TODO(jrg): find a way to add an [NSAutoreleasePool drain] in
+  // here.  I don't have access to the current
+  // scoped_nsautorelease_pool to do it properly :-(
+  [view removeFromSuperview];
+  [superview addSubview:view];
+
   [bar_ setHasToolbar:YES];
   EXPECT_EQ(view, [bar_ view]);
   EXPECT_TRUE([bar_ bookmarkBarController]);