I was looking through the code trying to see what might be going on in the crash in Issue 675854, and noticed that manage_passwords_decoration.h, content_setting_bubble_cocoa.h, and permission_bubble_controller.h all declare a decoration_ ivar which is a naked pointer to a C++ object. The comment says the reference is "weak" but I've never seen us maintain a weak reference to a C++ object. It looks like it's happening for other ivars, and in other classes in the Chrome codebase. I guess it's accepted practice, but it sure seems dangerous.

At a minimum there needs to be an explanation with each ivar explaining why it's OK that they're treated as weak.

One real problem is content_setting_bubble_cocoa declares the method -decorationForBubble, which simply returns the decoration_ ivar. It can't really know who is asking for this ivar, what lifetime the callee will assume the pointer has or how long it will hold onto the pointer, etc. This ivar cannot be weak in any way if it's going to be returned outside of the class.