Fixed potential crash on destroying MenuRunnerImplCocoa.

ui/views/controls/menu/menu_runner_cocoa_unittest.mm

Index: ui/views/controls/menu/menu_runner_cocoa_unittest.mm
diff --git a/ui/views/controls/menu/menu_runner_cocoa_unittest.mm b/ui/views/controls/menu/menu_runner_cocoa_unittest.mm
index 73e02eca385483f7d2994d045400cde586568f53..852a6debe46ae27806c3b96e90858f3ddd7ec9ab 100644
--- a/ui/views/controls/menu/menu_runner_cocoa_unittest.mm
+++ b/ui/views/controls/menu/menu_runner_cocoa_unittest.mm
@@ -137,6 +137,12 @@ class MenuRunnerCocoaTest : public ViewsTestBase {
     runner_ = nullptr;
   }
 
+  void MenuCancelAndDeleteCallback() {
+    runner_->Cancel();
+    runner_->Release();
+    runner_ = nullptr;
+  }
+
  protected:
   scoped_ptr<TestModel> menu_;
   internal::MenuRunnerImplCocoa* runner_ = nullptr;
@@ -182,6 +188,15 @@ TEST_F(MenuRunnerCocoaTest, RunMenuAndDelete) {
   EXPECT_EQ(MenuRunner::MENU_DELETED, result);
 }
 
+// Ensure a menu can be safely released immediately after a call to Cancel() in
+// the same run loop iteration.
+TEST_F(MenuRunnerCocoaTest, DestroyAfterCanceling) {
+  MenuRunner::RunResult result =
+      RunMenu(base::Bind(&MenuRunnerCocoaTest::MenuCancelAndDeleteCallback,
+                         base::Unretained(this)));
+  EXPECT_EQ(MenuRunner::MENU_DELETED, result);
+}
+
 TEST_F(MenuRunnerCocoaTest, RunMenuTwice) {
   for (int i = 0; i < 2; ++i) {
     MenuRunner::RunResult result = RunMenu(base::Bind(