Fixed potential crash on destroying MenuRunnerImplCocoa.

ui/views/controls/menu/menu_runner_impl_cocoa.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef UI_VIEWS_CONTROLS_MENU_MENU_RUNNER_IMPL_COCOA_H_
 #define UI_VIEWS_CONTROLS_MENU_MENU_RUNNER_IMPL_COCOA_H_
 
 #include "ui/views/controls/menu/menu_runner_impl_interface.h"
 
 #include <stdint.h>
@@ skipping 21 matching lines @@
                                   int32_t run_types) override;
   void Cancel() override;
   base::TimeDelta GetClosingEventTime() const override;
 
  private:
   ~MenuRunnerImplCocoa() override;
 
   // The Cocoa menu controller that this instance is bridging.
   base::scoped_nsobject<MenuController> menu_controller_;
 
+  // Are we in run waiting for it to return?
+  bool running_;
+
   // Set if |running_| and Release() has been invoked.
   bool delete_after_run_;
 
   // The timestamp of the event which closed the menu - or 0.
   base::TimeDelta closing_event_time_;
 
   DISALLOW_COPY_AND_ASSIGN(MenuRunnerImplCocoa);
 };
 
 }  // namespace internal
 }  // namespace views
 
 #endif  // UI_VIEWS_CONTROLS_MENU_MENU_RUNNER_IMPL_COCOA_H_