Oilpan: RenderMenuList should call PopupMenu::disconnectClient in destroy().

Source/core/rendering/RenderMenuList.cpp

 /*
  * This file is part of the select element renderer in WebCore.
  *
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  *               2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 47 matching lines @@
     , m_optionsChanged(true)
     , m_optionsWidth(0)
     , m_lastActiveIndex(-1)
     , m_popupIsVisible(false)
 {
     ASSERT(isHTMLSelectElement(element));
 }
 
 RenderMenuList::~RenderMenuList()
 {
+    ASSERT(!m_popup);
+}
+
+void RenderMenuList::destroy()
+{
     if (m_popup)
         m_popup->disconnectClient();
     m_popup = nullptr;
+    RenderFlexibleBox::destroy();
 }
 
 void RenderMenuList::trace(Visitor* visitor)
 {
     visitor->trace(m_buttonText);
     visitor->trace(m_innerBlock);
     RenderFlexibleBox::trace(visitor);
 }
 
 // FIXME: Instead of this hack we should add a ShadowRoot to <select> with no insertion point
@@ skipping 530 matching lines @@
     HTMLElement* element = listItems[listIndex];
     return isHTMLOptionElement(*element) && toHTMLOptionElement(*element).selected();
 }
 
 void RenderMenuList::setTextFromItem(unsigned listIndex)
 {
     setTextFromOption(selectElement()->listToOptionIndex(listIndex));
 }
 
 }