Bug 1504745, update the follow state before SetCaptureState as the nsMenuChainItem now stored in mPopups could be destroyed, r=tn

layout/xul/nsXULPopupManager.cpp

@@ -923,6 +923,8 @@ nsXULPopupManager::ShowPopupCallback(nsIContent* aPopup,
   aPopupFrame->ShowPopup(aIsContextMenu);
   NS_ENSURE_TRUE_VOID(weakFrame.IsAlive());
 
+  item->UpdateFollowAnchor();
+
   // popups normally hide when an outside click occurs. Panels may use
   // the noautohide attribute to disable this behaviour. It is expected
   // that the application will hide these popups manually. The tooltip
@@ -936,8 +938,6 @@ nsXULPopupManager::ShowPopupCallback(nsIContent* aPopup,
   SetCaptureState(oldmenu);
   NS_ENSURE_TRUE_VOID(weakFrame.IsAlive());
 
-  item->UpdateFollowAnchor();
-
   if (aSelectFirstItem) {
     nsMenuFrame* next = GetNextMenuItem(aPopupFrame, nullptr, true, false);
     aPopupFrame->SetCurrentMenuItem(next);