Fixes crash in closing menus. There are two issues here:

ui/views/controls/menu/menu_host.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef UI_VIEWS_CONTROLS_MENU_MENU_HOST_H_
 #define UI_VIEWS_CONTROLS_MENU_MENU_HOST_H_
 #pragma once
 
 #include "base/compiler_specific.h"
 #include "ui/gfx/rect.h"
@@ skipping 43 matching lines @@
 
   // Releases a mouse grab installed by |ShowMenuHost|.
   void ReleaseMenuHostCapture();
 
  private:
   // Overridden from Widget:
   virtual internal::RootView* CreateRootView() OVERRIDE;
   virtual bool ShouldReleaseCaptureOnMouseReleased() const OVERRIDE;
   virtual void OnMouseCaptureLost() OVERRIDE;
   virtual void OnNativeWidgetDestroyed() OVERRIDE;
+  virtual void OnOwnerClosing() OVERRIDE;
 
   // The view we contain.
   SubmenuView* submenu_;
 
   // If true, DestroyMenuHost has been invoked.
   bool destroying_;
 
   // If true and capture is lost we don't notify the delegate.
   bool ignore_capture_lost_;
 
   DISALLOW_COPY_AND_ASSIGN(MenuHost);
 };
 
 }  // namespace views
 
 #endif  // UI_VIEWS_CONTROLS_MENU_MENU_HOST_H_