Fixed potential crash on destroying MenuRunnerImplCocoa.

ui/views/controls/menu/menu_runner_cocoa_unittest.mm

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "ui/views/controls/menu/menu_runner_impl_cocoa.h"
 
 #import <Cocoa/Cocoa.h>
 
 #include "base/macros.h"
 #include "base/strings/utf_string_conversions.h"
@@ skipping 141 matching lines @@
 
 TEST_F(MenuRunnerCocoaTest, RunMenuAndDelete) {
   MenuRunner::RunResult result = RunMenu(^{
       runner_->Release();
       runner_ = NULL;
   });
 
   EXPECT_EQ(MenuRunner::MENU_DELETED, result);
 }
 
+// Tests that there is no "use after free" when we canceling menu
+// (that causes deferred destructor in MenuRunnerImplCocoa::RunMenuAt()) and
+// release it just after canceling (that was cause destructor
+// in MenuRunnerImplCocoa::Release()).

[tapted, 2016/04/12 06:22:58]

this comment is a bit hard to read perhaps

// Ensure a menu can be safely released immediately after a call to Cancel() in
the same run loop iteration.

+TEST_F(MenuRunnerCocoaTest, DestroyAfterCanceling) {
+  MenuRunner::RunResult result = RunMenu(^{

[tapted, 2016/04/12 06:22:58]

We got rid of all the Objective C blocks in this file recently - see
https://codereview.chromium.org/1829603002/ for the "new way" - you'll need to
sync past r385940 and rebase

+    runner_->Cancel();
+    runner_->Release();

[tapted, 2016/04/12 06:22:58]

Is there code in Chrome that already follows this pattern?

+    runner_ = nullptr;
+  });
+  EXPECT_EQ(MenuRunner::MENU_DELETED, result);
+}
+
 TEST_F(MenuRunnerCocoaTest, RunMenuTwice) {
   for (int i = 0; i < 2; ++i) {
     MenuRunner::RunResult result = RunMenu(^{
         runner_->Cancel();
     });
     EXPECT_EQ(MenuRunner::NORMAL_EXIT, result);
     EXPECT_FALSE(runner_->IsRunning());
   }
 }
 
@@ skipping 45 matching lines @@
   // In RTL, Cocoa messes up the positioning unless the anchor rectangle is
   // offset to the right of the view. The offset for the checkmark is also
   // skipped, to give a better match to native behavior.
   base::i18n::SetICUDefaultLocale("he");
   RunMenuAt(anchor_rect);
   EXPECT_EQ(combobox_rect.right(), last_anchor_frame_.origin.x);
 }
 
 }  // namespace test
 }  // namespace views