Textfield: Fix Clusterfuzz nullptr crash.

Clusterfuzz doesn't like it when there are two SimpleMenuModels in
existence. This CL fixes the reported TSAN crash, although I don't
completely understand why.

Bug: 918794
Change-Id: Ia3d9b341a1dc42cb8a956c283cac381dbb28e48c
Reviewed-on: https://chromium-review.googlesource.com/c/1435712Reviewed-by: Michael Wasserman <msw@chromium.org>
Commit-Queue: Tommy Li <tommycli@chromium.org>
Cr-Commit-Position: refs/heads/master@{#626237}

ui/views/controls/textfield/textfield.cc

@@ -2258,11 +2258,12 @@ bool Textfield::Paste() {
 
 void Textfield::UpdateContextMenu() {
   // TextfieldController may modify Textfield's menu, so the menu should be
-  // recreated each time it's shown. Reset the MenuRunner first so it doesn't
-  // reference the old menu model.
+  // recreated each time it's shown. Destroy the existing objects in the reverse
+  // order of creation.
   context_menu_runner_.reset();
+  context_menu_contents_.reset();
 
-  context_menu_contents_.reset(new ui::SimpleMenuModel(this));
+  context_menu_contents_ = std::make_unique<ui::SimpleMenuModel>(this);
   context_menu_contents_->AddItemWithStringId(IDS_APP_UNDO, IDS_APP_UNDO);
   context_menu_contents_->AddSeparator(ui::NORMAL_SEPARATOR);
   context_menu_contents_->AddItemWithStringId(IDS_APP_CUT, IDS_APP_CUT);