Release XP menu rollup listener before menu is executed. This restores normal event handling earlier. Fixes bug 15596. r:hyatt

layout/xul/base/src/nsMenuBarFrame.cpp

@@ -452,6 +452,12 @@ nsMenuBarFrame::Enter()
 NS_IMETHODIMP
 nsMenuBarFrame::HideChain()
 {
+  // Stop capturing rollups
+  // (must do this during Hide, which happens before the menu item is executed,
+  // since this reinstates normal event handling.)
+  if (nsMenuFrame::mDismissalListener)
+    nsMenuFrame::mDismissalListener->Unregister();
+
   if (mCurrentMenu) {
     mCurrentMenu->ActivateMenu(PR_FALSE);
     mCurrentMenu->SelectMenu(PR_FALSE);

layout/xul/base/src/nsMenuDismissalListener.cpp

@@ -109,8 +109,10 @@ nsMenuDismissalListener::Rollup()
 {
   if (mEnabled) {
     if (mMenuParent) {
+      AddRef();
       mMenuParent->HideChain();
       mMenuParent->DismissChain();
+      Release();
     }
     else
       Unregister();

layout/xul/base/src/nsMenuPopupFrame.cpp

@@ -616,6 +616,12 @@ nsMenuPopupFrame::GetParentPopup(nsIMenuParent** aMenuParent)
 NS_IMETHODIMP
 nsMenuPopupFrame::HideChain()
 {
+  // Stop capturing rollups
+  // (must do this during Hide, which happens before the menu item is executed,
+  // since this reinstates normal event handling.)
+  if (nsMenuFrame::mDismissalListener)
+    nsMenuFrame::mDismissalListener->Unregister();
+  
   nsIFrame* frame;
   GetParent(&frame);
   if (frame) {