Fix MenuRunner Releasing

ui/views/controls/menu/menu_runner_impl.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef UI_VIEWS_CONTROLS_MENU_MENU_RUNNER_IMPL_H_
 #define UI_VIEWS_CONTROLS_MENU_MENU_RUNNER_IMPL_H_
 
 #include <stdint.h>
 
 #include <set>
@@ skipping 68 matching lines @@
   // Set if |running_| and Release() has been invoked.
   bool delete_after_run_;
 
   // Are we running asynchronously?
   bool async_;
 
   // Are we running for a drop?
   bool for_drop_;
 
   // The controller.
-  MenuController* controller_;
+  base::WeakPtr<MenuController> controller_;
 
   // Do we own the controller?
   bool owns_controller_;
 
   // The timestamp of the event which closed the menu - or 0.
   base::TimeTicks closing_event_time_;
 
   // Used to detect deletion of |this| when notifying delegate of success.
   base::WeakPtrFactory<MenuRunnerImpl> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(MenuRunnerImpl);
 };
 
 }  // namespace internal
 }  // namespace views
 
 #endif  // UI_VIEWS_CONTROLS_MENU_MENU_RUNNER_IMPL_H_