Work around Mojave crash.

NSPopUpButtonCell in Mojave calls through the parent view at all
times, even during destruction. Work around this by properly
scoping the lifetime of the NSPopUpButtonCell in MenuButton, which
is something we weren't able to do in 10.5 but that was fixed
in 10.6 but that we never got around to updating.

BUG=869844

Change-Id: Iaecd978bc410810f02276f21ba13dd20ca73b195
Reviewed-on: https://chromium-review.googlesource.com/1159191
Commit-Queue: Sidney San Martín <sdy@chromium.org>
Reviewed-by: Sidney San Martín <sdy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#580032}

chrome/browser/ui/cocoa/menu_button.h

@@ -30,7 +30,6 @@
   BOOL openMenuOnClick_;
   BOOL openMenuOnRightClick_;
   BOOL openMenuOnClickHold_;
-  base::scoped_nsobject<NSPopUpButtonCell> popUpCell_;
 }
 
 // The menu to display. Note that it should have no (i.e., a blank) title and

chrome/browser/ui/cocoa/menu_button.mm

@@ -184,18 +184,13 @@
   // However, using a pulldown has the benefit that Cocoa automatically places
   // the menu correctly even when we're at the edge of the screen (including
   // "dragging upwards" when the button is close to the bottom of the screen).
-  // A |scoped_nsobject| local variable cannot be used here because
-  // Accessibility on 10.5 grabs the NSPopUpButtonCell without retaining it, and
-  // uses it later. (This is fixed in 10.6.)
-  if (!popUpCell_.get()) {
-    popUpCell_.reset([[NSPopUpButtonCell alloc] initTextCell:@""
-                                                   pullsDown:YES]);
-  }
-  DCHECK(popUpCell_.get());
-  [popUpCell_ setMenu:[self attachedMenu]];
-  [popUpCell_ selectItem:nil];
-  [popUpCell_ attachPopUpWithFrame:frame inView:self];
-  [popUpCell_ performClickWithFrame:frame inView:self];
+  base::scoped_nsobject<NSPopUpButtonCell> popUpCell(
+      [[NSPopUpButtonCell alloc] initTextCell:@"" pullsDown:YES]);
+
+  [popUpCell setMenu:[self attachedMenu]];
+  [popUpCell selectItem:nil];
+  [popUpCell attachPopUpWithFrame:frame inView:self];
+  [popUpCell performClickWithFrame:frame inView:self];
 
   // Once the menu is dismissed send a mouseExited event if necessary. If the
   // menu action caused the super view to resize then we won't automatically