Oilpan: RenderMenuList should call PopupMenu::disconnectClient in destroy().

Source/core/rendering/RenderMenuList.h

 /*
  * This file is part of the select element renderer in WebCore.
  *
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 21 matching lines @@
 namespace blink {
 
 class HTMLSelectElement;
 class RenderText;
 
 class RenderMenuList FINAL : public RenderFlexibleBox, private PopupMenuClient {
 
 public:
     RenderMenuList(Element*);
     virtual ~RenderMenuList();
+    virtual void destroy() OVERRIDE;
     virtual void trace(Visitor*) OVERRIDE;
 
-public:
     bool popupIsVisible() const { return m_popupIsVisible; }
     void showPopup();
     void hidePopup();
 
     void setOptionsChanged(bool changed) { m_optionsChanged = changed; }
 
     void didSetSelectedIndex(int listIndex);
 
     String text() const;
 
@@ skipping 76 matching lines @@
 
     RefPtr<PopupMenu> m_popup;
     bool m_popupIsVisible;
 };
 
 DEFINE_RENDER_OBJECT_TYPE_CASTS(RenderMenuList, isMenuList());
 
 }
 
 #endif