views: make sure MenuPreTargetHandlerAura removes observer from Env

If root_ was destroyed while MenuPreTargetHandlerAura exists, then
MenuPreTargetHandlerAura would set root_ to null. This would result
in the pre-target-handler being removed from the wrong env.

I don't think this is the result of the bug referenced, but I came across
this in looking for bad pre-target handlers.

BUG=867035
TEST=none

Change-Id: Ic549cf306441e31dcd750665992e41f06416f295
Reviewed-on: https://chromium-review.googlesource.com/c/1279147Reviewed-by: Jun Mukai <mukai@chromium.org>
Commit-Queue: Scott Violet <sky@chromium.org>
Cr-Commit-Position: refs/heads/master@{#599351}

ui/views/controls/menu/menu_pre_target_handler_aura.cc

@@ -25,7 +25,7 @@ MenuPreTargetHandlerAura::MenuPreTargetHandlerAura(MenuController* controller,
                                                    Widget* owner)
     : controller_(controller), root_(GetOwnerRootWindow(owner)) {
   if (root_) {
-    root_->env()->AddPreTargetHandler(this, ui::EventTarget::Priority::kSystem);
+    aura_env_ = root_->env();
     wm::GetActivationClient(root_)->AddObserver(this);
     root_->AddObserver(this);
   } else {
@@ -35,16 +35,13 @@ MenuPreTargetHandlerAura::MenuPreTargetHandlerAura(MenuController* controller,
       LOG(WARNING) << "MenuPreTargetHandlerAura is created without owner "
                    << "widget. This may not work well in SingleProcessMash.";
     }
-    aura::Env::GetInstance()->AddPreTargetHandler(
-        this, ui::EventTarget::Priority::kSystem);
+    aura_env_ = aura::Env::GetInstance();
   }
+  aura_env_->AddPreTargetHandler(this, ui::EventTarget::Priority::kSystem);
 }
 
 MenuPreTargetHandlerAura::~MenuPreTargetHandlerAura() {
-  if (root_)
-    root_->env()->RemovePreTargetHandler(this);
-  else
-    aura::Env::GetInstance()->RemovePreTargetHandler(this);
+  aura_env_->RemovePreTargetHandler(this);
   Cleanup();
 }
 

ui/views/controls/menu/menu_pre_target_handler_aura.h

@@ -12,6 +12,7 @@
 #include "ui/wm/public/activation_change_observer.h"
 
 namespace aura {
+class Env;
 class Window;
 }  // namespace aura
 
@@ -48,6 +49,7 @@ class VIEWS_EXPORT MenuPreTargetHandlerAura
  private:
   void Cleanup();
 
+  aura::Env* aura_env_ = nullptr;
   MenuController* controller_;
   aura::Window* root_;