Fixed potential crash on destroying MenuRunnerImplCocoa.

ui/views/controls/menu/menu_runner_impl_cocoa.mm

Index: ui/views/controls/menu/menu_runner_impl_cocoa.mm
diff --git a/ui/views/controls/menu/menu_runner_impl_cocoa.mm b/ui/views/controls/menu/menu_runner_impl_cocoa.mm
index 454c951817bbf6cba4efaf8acea43c8038dee911..94065833ee0a491199fa877d4e2a58ef63a405bd 100644
--- a/ui/views/controls/menu/menu_runner_impl_cocoa.mm
+++ b/ui/views/controls/menu/menu_runner_impl_cocoa.mm
@@ -93,7 +93,9 @@ MenuRunnerImplInterface* MenuRunnerImplInterface::Create(
 }
 
 MenuRunnerImplCocoa::MenuRunnerImplCocoa(ui::MenuModel* menu)
-    : delete_after_run_(false), closing_event_time_(base::TimeDelta()) {
+    : delete_after_run_(false),
+      in_menu_runloop_(false),
+      closing_event_time_(base::TimeDelta()) {
   menu_controller_.reset(
       [[MenuController alloc] initWithModel:menu useWithPopUpButtonCell:NO]);
 }
@@ -103,7 +105,7 @@ bool MenuRunnerImplCocoa::IsRunning() const {
 }
 
 void MenuRunnerImplCocoa::Release() {
-  if (IsRunning()) {
+  if (IsRunning() || in_menu_runloop_) {

[tapted, 2016/04/12 06:22:58]

that way this can stay as just IsRunning()

     if (delete_after_run_)
       return;  // We already canceled.
 
@@ -123,6 +125,7 @@ MenuRunner::RunResult MenuRunnerImplCocoa::RunMenuAt(Widget* parent,
   DCHECK(!IsRunning());
   DCHECK(parent);
   closing_event_time_ = base::TimeDelta();
+  in_menu_runloop_ = true;
 
   if (run_types & MenuRunner::CONTEXT_MENU) {
     [NSMenu popUpContextMenu:[menu_controller_ menu]
@@ -143,6 +146,7 @@ MenuRunner::RunResult MenuRunnerImplCocoa::RunMenuAt(Widget* parent,
   }
 
   closing_event_time_ = ui::EventTimeForNow();
+  in_menu_runloop_ = false;
 
   if (delete_after_run_) {
     delete this;