Fix for bug 11299.

layout/xul/base/src/nsMenuBarFrame.cpp

@@ -79,17 +79,21 @@ NS_IMETHODIMP nsMenuBarFrame::QueryInterface(REFNSIID aIID, void** aInstancePtr)
     return NS_OK;                                                        
   }   
 
-  return nsBoxFrame::QueryInterface(aIID, aInstancePtr);                                     
+  return nsToolbarFrame::QueryInterface(aIID, aInstancePtr);                                     
 }
 //
 // nsMenuBarFrame cntr
 //
 nsMenuBarFrame::nsMenuBarFrame()
-:mIsActive(PR_FALSE)
+:mIsActive(PR_FALSE), mTarget(nsnull)
 {
 
 } // cntr
 
+nsMenuBarFrame::~nsMenuBarFrame()
+{
+}
+
 NS_IMETHODIMP
 nsMenuBarFrame::Init(nsIPresContext&  aPresContext,
                      nsIContent*      aContent,
@@ -97,7 +101,7 @@ nsMenuBarFrame::Init(nsIPresContext&  aPresContext,
                      nsIStyleContext* aContext,
                      nsIFrame*        aPrevInFlow)
 {
-  nsresult  rv = nsBoxFrame::Init(aPresContext, aContent, aParent, aContext, aPrevInFlow);
+  nsresult  rv = nsToolbarFrame::Init(aPresContext, aContent, aParent, aContext, aPrevInFlow);
 
   // Create the menu bar listener.
   mMenuBarListener = new nsMenuBarListener(this);
@@ -109,6 +113,8 @@ nsMenuBarFrame::Init(nsIPresContext&  aPresContext,
   nsCOMPtr<nsIDOMEventReceiver> target = do_QueryInterface(doc);
   nsIDOMEventListener* domEventListener = (nsIDOMKeyListener*)mMenuBarListener;
 
+  mTarget = target;
+
   target->AddEventListener("keypress", domEventListener, PR_TRUE); 
 	target->AddEventListener("keydown", domEventListener, PR_TRUE);  
   target->AddEventListener("keyup", domEventListener, PR_TRUE);   
@@ -459,3 +465,16 @@ nsMenuBarFrame::IsDisabled(nsIContent* aContent)
     return PR_TRUE;
   return PR_FALSE;
 }
+
+NS_IMETHODIMP
+nsMenuBarFrame::Destroy(nsIPresContext& aPresContext)
+{
+  mTarget->RemoveEventListener("keypress", mMenuBarListener, PR_TRUE); 
+	mTarget->RemoveEventListener("keydown", mMenuBarListener, PR_TRUE);  
+  mTarget->RemoveEventListener("keyup", mMenuBarListener, PR_TRUE);
+
+  delete mMenuBarListener;
+  mMenuBarListener = nsnull;
+
+  return nsToolbarFrame::Destroy(aPresContext);
+}

layout/xul/base/src/nsMenuBarFrame.h

@@ -38,6 +38,7 @@ class nsMenuBarFrame : public nsToolbarFrame, public nsIMenuParent
 {
 public:
   nsMenuBarFrame();
+  ~nsMenuBarFrame();
 
   NS_DECL_ISUPPORTS
 
@@ -63,6 +64,8 @@ public:
                   nsIStyleContext* aContext,
                   nsIFrame*        aPrevInFlow);
 
+  NS_IMETHOD Destroy(nsIPresContext& aPresContext);
+
 // Non-interface helpers
 
   // Called when a menu on the menu bar is clicked on.
@@ -88,6 +91,9 @@ protected:
   nsMenuBarListener* mMenuBarListener; // The listener that tells us about key and mouse events.
   PRBool mIsActive; // Whether or not the menu bar is active (a menu item is highlighted or shown).
   nsIFrame* mCurrentMenu; // The current menu that is active.
+
+  nsIDOMEventReceiver* mTarget;
+
 }; // class nsMenuBarFrame
 
 #endif