Fix crash caused by having accessibility turned on.

BUG=http://crbug.com/31007
TEST=as in bug

Review URL: http://codereview.chromium.org/548015

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@36164 0039d316-1c4b-4281-b951-d872f2087c98

4 files changed, 30 insertions, 18 deletions

diff --git a/chrome/browser/cocoa/delayedmenu_button.h b/chrome/browser/cocoa/delayedmenu_button.h
index 1c0547e..45cc856 100644
--- a/chrome/browser/cocoa/delayedmenu_button.h
+++ b/chrome/browser/cocoa/delayedmenu_button.h
@@ -12,6 +12,7 @@
 @interface DelayedMenuButton : NSButton {
   NSMenu* attachedMenu_;  // Strong (retained).
   BOOL attachedMenuEnabled_;
+  scoped_nsobject<NSPopUpButtonCell> popUpCell_;
 }
 
 // The menu to display. Note that it should have no (i.e., a blank) title and
diff --git a/chrome/browser/cocoa/delayedmenu_button.mm b/chrome/browser/cocoa/delayedmenu_button.mm
index 7243285..dbbde4a 100644
--- a/chrome/browser/cocoa/delayedmenu_button.mm
+++ b/chrome/browser/cocoa/delayedmenu_button.mm
@@ -118,16 +118,20 @@
   // However, using a pulldown has the benefit that Cocoa automatically places
   // the menu correctly even when we're at the edge of the screen (including
   // "dragging upwards" when the button is close to the bottom of the screen).
-  scoped_nsobject<NSPopUpButtonCell> popUpCell(
-      [[NSPopUpButtonCell alloc] initTextCell:@""
-                                    pullsDown:YES]);
-  DCHECK(popUpCell.get());
-  [popUpCell setMenu:attachedMenu_];
-  [popUpCell selectItem:nil];
-  [popUpCell attachPopUpWithFrame:frame
-                           inView:self];
-  [popUpCell performClickWithFrame:frame
+  // A |scoped_nsobject| local variable cannot be used here because
+  // Accessibility on 10.5 grabs the NSPopUpButtonCell without retaining it, and
+  // uses it later. (This is fixed in 10.6.)
+  if (!popUpCell_.get()) {
+    popUpCell_.reset([[NSPopUpButtonCell alloc] initTextCell:@""
+                                                   pullsDown:YES]);
+  }
+  DCHECK(popUpCell_.get());
+  [popUpCell_ setMenu:attachedMenu_];
+  [popUpCell_ selectItem:nil];
+  [popUpCell_ attachPopUpWithFrame:frame
                             inView:self];
+  [popUpCell_ performClickWithFrame:frame
+                             inView:self];
 }
 
 @end  // @implementation DelayedMenuButton (Private)
diff --git a/chrome/browser/cocoa/menu_button.h b/chrome/browser/cocoa/menu_button.h
index c281e77..c03caa2 100644
--- a/chrome/browser/cocoa/menu_button.h
+++ b/chrome/browser/cocoa/menu_button.h
@@ -7,12 +7,15 @@
 
 #import <Cocoa/Cocoa.h>
 
+#include "base/scoped_nsobject.h"
+
 // This a button which displays a user-provided menu "attached" below it upon
 // being clicked or dragged (or clicked and held). It expects a
 // |ClickHoldButtonCell| as cell.
 @interface MenuButton : NSButton {
  @private
   IBOutlet NSMenu* attachedMenu_;
+  scoped_nsobject<NSPopUpButtonCell> popUpCell_;
 }
 
 // The menu to display. Note that it should have no (i.e., a blank) title and
diff --git a/chrome/browser/cocoa/menu_button.mm b/chrome/browser/cocoa/menu_button.mm
index bbe55da..f94646f 100644
--- a/chrome/browser/cocoa/menu_button.mm
+++ b/chrome/browser/cocoa/menu_button.mm
@@ -92,16 +92,20 @@
   // However, using a pulldown has the benefit that Cocoa automatically places
   // the menu correctly even when we're at the edge of the screen (including
   // "dragging upwards" when the button is close to the bottom of the screen).
-  scoped_nsobject<NSPopUpButtonCell> popUpCell(
-      [[NSPopUpButtonCell alloc] initTextCell:@""
-                                    pullsDown:YES]);
-  DCHECK(popUpCell.get());
-  [popUpCell setMenu:[self attachedMenu]];
-  [popUpCell selectItem:nil];
-  [popUpCell attachPopUpWithFrame:frame
-                           inView:self];
-  [popUpCell performClickWithFrame:frame
+  // A |scoped_nsobject| local variable cannot be used here because
+  // Accessibility on 10.5 grabs the NSPopUpButtonCell without retaining it, and
+  // uses it later. (This is fixed in 10.6.)
+  if (!popUpCell_.get()) {
+    popUpCell_.reset([[NSPopUpButtonCell alloc] initTextCell:@""
+                                                   pullsDown:YES]);
+  }
+  DCHECK(popUpCell_.get());
+  [popUpCell_ setMenu:[self attachedMenu]];
+  [popUpCell_ selectItem:nil];
+  [popUpCell_ attachPopUpWithFrame:frame
                             inView:self];
+  [popUpCell_ performClickWithFrame:frame
+                             inView:self];
 }
 
 // Called when the button is clicked and released. (Shouldn't happen with