Gracefully handle a disconnected popup menu client on disposing open popup.

Source/web/PopupMenuImpl.cpp

 // Copyright (c) 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "web/PopupMenuImpl.h"
 
 #include "core/HTMLNames.h"
 #include "core/css/CSSFontSelector.h"
 #include "core/dom/StyleEngine.h"
@@ skipping 216 matching lines @@
     ASSERT(m_client);
     bool success;
     int listIndex = value.toInt(&success);
     ASSERT(success);
     m_client->setTextFromItem(listIndex);
     m_indexToSetOnClose = listIndex;
 }
 
 void PopupMenuImpl::didClosePopup()
 {
-    if (m_indexToSetOnClose >= 0)
+    if (m_client && m_indexToSetOnClose >= 0)
         m_client->valueChanged(m_indexToSetOnClose);
     m_indexToSetOnClose = -1;
     m_popup = nullptr;
-    m_client->popupDidHide();
+    if (m_client)
+        m_client->popupDidHide();
 }
 
 Element& PopupMenuImpl::ownerElement()
 {
     return m_client->ownerElement();
 }
 
 Locale& PopupMenuImpl::locale()
 {
     return Locale::defaultLocale();
@@ skipping 48 matching lines @@
 #if ENABLE(OILPAN)
     // Cannot be done during finalization, so instead done when the
     // render object is destroyed and disconnected.
     //
     // FIXME: do this always, regardless of ENABLE(OILPAN).
     dispose();
 #endif
 }
 
 } // namespace blink