Fix MenuRunnerImpl Crash for context menu during drag-and-drop

ui/views/controls/menu/menu_runner_impl.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/views/controls/menu/menu_runner_impl.h"
 
 #include "build/build_config.h"
 #include "ui/native_theme/native_theme.h"
 #include "ui/views/controls/button/menu_button.h"
 #include "ui/views/controls/menu/menu_controller.h"
@@ skipping 70 matching lines @@
     // doesn't handle this very well (meaning it crashes).
     return MenuRunner::NORMAL_EXIT;
   }
 
   MenuController* controller = MenuController::GetActiveInstance();
   if (controller) {
     if ((run_types & MenuRunner::IS_NESTED) != 0) {
       if (!controller->IsBlockingRun()) {
         controller->CancelAll();
         controller = NULL;
+      } else {
+        // Only nest the delegate when not cancelling drag-and-drop. When
+        // cancelling this will become the root delegate of the new
+        // MenuController
+        controller->AddNestedDelegate(this);
       }
-      controller->AddNestedDelegate(this);
     } else {
       // There's some other menu open and we're not nested. Cancel the menu.
       controller->CancelAll();
       if ((run_types & MenuRunner::FOR_DROP) == 0) {
         // We can't open another menu, otherwise the message loop would become
         // twice nested. This isn't necessarily a problem, but generally isn't
         // expected.
         return MenuRunner::NORMAL_EXIT;
       }
       // Drop menus don't block the message loop, so it's ok to create a new
@@ skipping 112 matching lines @@
 #if defined(OS_WIN)
   // This is only needed on Windows.
   if (!show_mnemonics)
     show_mnemonics = ui::win::IsAltPressed();
 #endif
   return show_mnemonics;
 }
 
 }  // namespace internal
 }  // namespace views