Fix crasher on linux for tooltips. Widget was going away before we could unregister things. Make sure we addref it if we're going to hold onto it for an extended period of time. Thanks alecf for finding this. bug # 38547.

layout/xul/base/src/nsMenuDismissalListener.cpp

@@ -38,7 +38,7 @@ NS_IMPL_QUERY_INTERFACE3(nsMenuDismissalListener, nsIDOMMouseListener, nsIMenuRo
 ////////////////////////////////////////////////////////////////////////
 
 nsMenuDismissalListener::nsMenuDismissalListener() :
-  mWidget(0), mEnabled(PR_TRUE)
+  mEnabled(PR_TRUE)
 {
   NS_INIT_REFCNT();
   mMenuParent = nsnull;
@@ -162,8 +162,10 @@ nsMenuDismissalListener::NextMenuParent(nsIMenuParent * inCurrent, nsIMenuParent
 NS_IMETHODIMP
 nsMenuDismissalListener::Unregister()
 {
-  if (mWidget)
-    mWidget->CaptureRollupEvents(this, PR_FALSE, PR_FALSE);    
+  if (mWidget) {
+    mWidget->CaptureRollupEvents(this, PR_FALSE, PR_FALSE);
+    mWidget = nsnull;
+  }
   
   NS_RELEASE(nsMenuFrame::mDismissalListener);
   return NS_OK;

layout/xul/base/src/nsMenuDismissalListener.h

@@ -29,6 +29,7 @@
 #include "nsIRollupListener.h"
 #include "nsIMenuRollup.h"
 #include "nsIDOMEventReceiver.h"
+#include "nsCOMPtr.h"
 
 class nsMenuPopupFrame;
 class nsIPresContext;
@@ -66,7 +67,7 @@ public:
   
 protected:
   nsIMenuParent* mMenuParent;
-  nsIWidget* mWidget;
+  nsCOMPtr<nsIWidget> mWidget;
   PRBool mEnabled;
 };