Gtk: fix reference counting/destruction of GtkMenu* in MenuGtk.

regression caused by r35404 

credit to Bryan Yeung for finding the bug 

BUG=31977, 31765, 32514, 31988
TEST=see bugs

Review URL: http://codereview.chromium.org/552044

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@36559 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 6 insertions, 0 deletions

diff --git a/chrome/browser/gtk/menu_gtk.cc b/chrome/browser/gtk/menu_gtk.cc
index c4aecb0..67de7b3 100644
--- a/chrome/browser/gtk/menu_gtk.cc
+++ b/chrome/browser/gtk/menu_gtk.cc
@@ -28,6 +28,7 @@ MenuGtk::MenuGtk(MenuGtk::Delegate* delegate,
       menu_(gtk_menu_new()),
       factory_(this) {
   DCHECK(menu_data);
+  g_object_ref_sink(menu_);
   ConnectSignalHandlers();
   BuildMenuIn(menu_, menu_data);
 }
@@ -38,6 +39,7 @@ MenuGtk::MenuGtk(MenuGtk::Delegate* delegate)
       dummy_accel_group_(gtk_accel_group_new()),
       menu_(gtk_menu_new()),
       factory_(this) {
+  g_object_ref_sink(menu_);
   ConnectSignalHandlers();
 }
 
@@ -48,6 +50,7 @@ MenuGtk::MenuGtk(MenuGtk::Delegate* delegate,
       dummy_accel_group_(gtk_accel_group_new()),
       menu_(gtk_menu_new()),
       factory_(this) {
+  g_object_ref_sink(menu_);
   DCHECK(model);
   ConnectSignalHandlers();
   if (model)
@@ -55,6 +58,9 @@ MenuGtk::MenuGtk(MenuGtk::Delegate* delegate,
 }
 
 MenuGtk::~MenuGtk() {
+  Cancel();
+  g_object_unref(menu_);
+
   STLDeleteContainerPointers(submenus_we_own_.begin(), submenus_we_own_.end());
   g_object_unref(dummy_accel_group_);
 }