Fix use after free in SearchResultTileItemView

ui/app_list/views/search_result_tile_item_view.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/app_list/views/search_result_tile_item_view.h"
 
 #include "ui/app_list/app_list_view_delegate.h"
 #include "ui/app_list/search_result.h"
 #include "ui/app_list/views/search_result_container_view.h"
 #include "ui/views/controls/menu/menu_runner.h"
@@ skipping 58 matching lines @@
   }
 
   return false;
 }
 
 void SearchResultTileItemView::OnIconChanged() {
   SetIcon(item_->icon());
 }
 
 void SearchResultTileItemView::OnResultDestroying() {
+  // The menu comes from |item_|. If we're showing a menu we need to cancel it.
+  context_menu_runner_.reset();
+
   if (item_)
     item_->RemoveObserver(this);
   item_ = NULL;
 }
 
 void SearchResultTileItemView::ShowContextMenuForView(
     views::View* source,
     const gfx::Point& point,
     ui::MenuSourceType source_type) {
   // |item_| could be null when result list is changing.
@@ skipping 12 matching lines @@
   // If RunMenuAt() fails, return immediately. This is future-proofing for
   // adding code after this call.
   if (context_menu_runner_->RunMenuAt(
           GetWidget(), nullptr, gfx::Rect(point, gfx::Size()),
           views::MENU_ANCHOR_TOPLEFT,
           source_type) == views::MenuRunner::MENU_DELETED)
     return;
 }
 
 }  // namespace app_list