Oilpan: RenderMenuList should call PopupMenu::disconnectClient in destroy().

PopupMenu::disconnectClient accesses some objects, and they might be destructed
when a RenderMenuList object is garbage collected. We should call
PopupMenu::disconnectClient earlier.

This fixes SelectPopupMenuStyleTest.PopupListBoxRTLRowWidth in Oilpan.

BUG=402439

Review URL: https://codereview.chromium.org/459313002

git-svn-id: svn://svn.chromium.org/blink/trunk@180023 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/Source/core/rendering/RenderMenuList.cpp

@@ -64,10 +64,16 @@ RenderMenuList::RenderMenuList(Element* element)
 }
 
 RenderMenuList::~RenderMenuList()
+{
+    ASSERT(!m_popup);
+}
+
+void RenderMenuList::destroy()
 {
     if (m_popup)
         m_popup->disconnectClient();
     m_popup = nullptr;
+    RenderFlexibleBox::destroy();
 }
 
 void RenderMenuList::trace(Visitor* visitor)

third_party/WebKit/Source/core/rendering/RenderMenuList.h

@@ -39,9 +39,9 @@ class RenderMenuList FINAL : public RenderFlexibleBox, private PopupMenuClient {
 public:
     RenderMenuList(Element*);
     virtual ~RenderMenuList();
+    virtual void destroy() OVERRIDE;
     virtual void trace(Visitor*) OVERRIDE;
 
-public:
     bool popupIsVisible() const { return m_popupIsVisible; }
     void showPopup();
     void hidePopup();