RenderWidgetHostViewMac should release its owning RenderWidgetHostViewCocoa

in Destroy when the widget was a native (external) pop-up menu.

This change depends on WebKit r51102
(https://bugs.webkit.org/show_bug.cgi?id=31609).

BUG=27723, 26876
TEST=1. Following the steps in bug 27723 comment 5 should not result in a sad
        tab:
         a. Open Google Calendar
         b. Bring up a recurring event
         c. Click the "Edit" link on the "Repeat" line beneath "When"
         d. Change the value of the "Repeat Every" drop-down menu
     2. Also, web content pop-up menus should work more generally.
     3. After using a web content pop-up menu and then closing all windows,
        there should not be any renderer processes running.
Review URL: http://codereview.chromium.org/397039

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@32364 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 13 insertions, 4 deletions

diff --git a/chrome/browser/renderer_host/render_widget_host_view_mac.h b/chrome/browser/renderer_host/render_widget_host_view_mac.h
index 67c8abf..0e65cef 100644
--- a/chrome/browser/renderer_host/render_widget_host_view_mac.h
+++ b/chrome/browser/renderer_host/render_widget_host_view_mac.h
@@ -32,7 +32,7 @@ class RWHVMEditCommandHelper;
 @interface RenderWidgetHostViewCocoa
     : BaseView <RenderWidgetHostViewMacOwner, NSTextInput, NSChangeSpelling> {
  @private
-  RenderWidgetHostViewMac* renderWidgetHostView_;  // Owned by us.
+  scoped_ptr<RenderWidgetHostViewMac> renderWidgetHostView_;
   BOOL canBeKeyView_;
   BOOL closeOnDeactivate_;
   scoped_ptr<RWHVMEditCommandHelper> editCommand_helper_;
@@ -41,7 +41,7 @@ class RWHVMEditCommandHelper;
   id trackingRectOwner_;              // (not retained)
   void *trackingRectUserData_;
   NSTrackingRectTag lastToolTipTag_;
-  NSString* toolTip_;
+  scoped_nsobject<NSString> toolTip_;
 
   BOOL ignoreKeyEvents_;
   scoped_nsobject<NSEvent> lastKeyPressedEvent_;
@@ -195,8 +195,13 @@ class RenderWidgetHostViewMac : public RenderWidgetHostView {
   // invoke it from the message loop.
   void ShutdownHost();
 
-  // The associated view.
-  RenderWidgetHostViewCocoa* cocoa_view_;  // WEAK
+  // The associated view. This is weak and is inserted into the view hierarchy
+  // to own this RenderWidgetHostViewMac object unless is_popup_menu_ is true.
+  // In that case, cocoa_view_ is never inserted into the view hierarchy, so
+  // the RenderWidgetHostViewMac will treat it as a strong reference and will
+  // release it when told to destroy (for example, because a pop-up menu has
+  // closed).
+  RenderWidgetHostViewCocoa* cocoa_view_;
 
   // The cursor for the page. This is passed up from the renderer.
   WebCursor current_cursor_;
@@ -207,6 +212,10 @@ class RenderWidgetHostViewMac : public RenderWidgetHostView {
   // true if the View is not visible.
   bool is_hidden_;
 
+  // True if the widget is a native popup menu.  The renderer code calls this
+  // an "external popup."
+  bool is_popup_menu_;
+
   // The text to be shown in the tooltip, supplied by the renderer.
   std::wstring tooltip_text_;