Fixed potential crash on destroying MenuRunnerImplCocoa.

ui/views/controls/menu/menu_runner_cocoa_unittest.mm

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "ui/views/controls/menu/menu_runner_impl_cocoa.h"
 
 #import <Cocoa/Cocoa.h>
 
 #include "base/macros.h"
 #include "base/strings/utf_string_conversions.h"
@@ skipping 119 matching lines @@
   void MenuCancelCallback() {
     runner_->Cancel();
     EXPECT_FALSE(runner_->IsRunning());
   }
 
   void MenuDeleteCallback() {
     runner_->Release();
     runner_ = nullptr;
   }
 
+  void MenuCancelAndDeleteCallback() {
+    runner_->Cancel();
+    runner_->Release();
+    runner_ = nullptr;
+  }
+
  protected:
   scoped_ptr<TestModel> menu_;
   internal::MenuRunnerImplCocoa* runner_ = nullptr;
   views::Widget* parent_ = nullptr;
   NSRect last_anchor_frame_ = NSZeroRect;
 
  private:
   void RunMenuWrapperCallback(const base::Closure& callback) {
     EXPECT_TRUE(runner_->IsRunning());
     callback.Run();
@@ skipping 25 matching lines @@
   runner_->Cancel();
   EXPECT_FALSE(runner_->IsRunning());
 }
 
 TEST_F(MenuRunnerCocoaTest, RunMenuAndDelete) {
   MenuRunner::RunResult result = RunMenu(base::Bind(
       &MenuRunnerCocoaTest::MenuDeleteCallback, base::Unretained(this)));
   EXPECT_EQ(MenuRunner::MENU_DELETED, result);
 }
 
+// Ensure a menu can be safely released immediately after a call to Cancel() in
+// the same run loop iteration.
+TEST_F(MenuRunnerCocoaTest, DestroyAfterCanceling) {
+  MenuRunner::RunResult result =
+      RunMenu(base::Bind(&MenuRunnerCocoaTest::MenuCancelAndDeleteCallback,
+                         base::Unretained(this)));
+  EXPECT_EQ(MenuRunner::MENU_DELETED, result);
+}
+
 TEST_F(MenuRunnerCocoaTest, RunMenuTwice) {
   for (int i = 0; i < 2; ++i) {
     MenuRunner::RunResult result = RunMenu(base::Bind(
         &MenuRunnerCocoaTest::MenuCancelCallback, base::Unretained(this)));
     EXPECT_EQ(MenuRunner::NORMAL_EXIT, result);
     EXPECT_FALSE(runner_->IsRunning());
   }
 }
 
 TEST_F(MenuRunnerCocoaTest, CancelWithoutRunning) {
@@ skipping 44 matching lines @@
   // In RTL, Cocoa messes up the positioning unless the anchor rectangle is
   // offset to the right of the view. The offset for the checkmark is also
   // skipped, to give a better match to native behavior.
   base::i18n::SetICUDefaultLocale("he");
   RunMenuAt(anchor_rect);
   EXPECT_EQ(combobox_rect.right(), last_anchor_frame_.origin.x);
 }
 
 }  // namespace test
 }  // namespace views