Add KillPendingTimers() to nsIMenuParent and call it when we open a sibling

submenu. Not clearing out this timer causes confusion with the rollup
listeners. Fixes 48989 and 28309. Thanks to Dean, who put me on the right
track. r=hyatt.

layout/xul/base/public/nsIMenuParent.h

@@ -49,6 +49,7 @@ public:
 
   NS_IMETHOD DismissChain() = 0;
   NS_IMETHOD HideChain() = 0;
+  NS_IMETHOD KillPendingTimers() = 0;
 
   NS_IMETHOD CreateDismissalListener() = 0;
 

layout/xul/base/src/nsIMenuParent.h

@@ -49,6 +49,7 @@ public:
 
   NS_IMETHOD DismissChain() = 0;
   NS_IMETHOD HideChain() = 0;
+  NS_IMETHOD KillPendingTimers() = 0;
 
   NS_IMETHOD CreateDismissalListener() = 0;
 

layout/xul/base/src/nsMenuBarFrame.cpp

@@ -581,6 +581,15 @@ nsMenuBarFrame::DismissChain()
   return NS_OK;
 }
 
+
+NS_IMETHODIMP
+nsMenuBarFrame :: KillPendingTimers ( )
+{
+  return NS_OK;
+
+} // KillPendingTimers
+
+
 NS_IMETHODIMP
 nsMenuBarFrame::GetWidget(nsIWidget **aWidget)
 {
@@ -682,3 +691,4 @@ nsMenuBarFrame::Destroy(nsIPresContext* aPresContext)
 
   return nsBoxFrame::Destroy(aPresContext);
 }
+

layout/xul/base/src/nsMenuBarFrame.h

@@ -68,6 +68,7 @@ public:
   NS_IMETHOD IsActive() { return mIsActive; };
 
   NS_IMETHOD IsOpen();
+  NS_IMETHOD KillPendingTimers();
 
   // Closes up the chain of open cascaded menus.
   NS_IMETHOD DismissChain();

layout/xul/base/src/nsMenuFrame.cpp

@@ -333,8 +333,17 @@ nsMenuFrame::HandleEvent(nsIPresContext* aPresContext,
       }
     }
     else
-      if ( !IsOpen() )
+      if ( !IsOpen() ) {
+        // one of our siblings is probably open and even possibly waiting
+        // for its close timer to fire. Tell our parent to close it down. Not
+        // doing this before its timer fires will cause the rollup state to
+        // get very confused.
+        if ( mMenuParent )
+          mMenuParent->KillPendingTimers();
+
+        // safe to open up
         OpenMenu(PR_TRUE);
+      }
   }
   else if ( aEvent->message == NS_MOUSE_RIGHT_BUTTON_UP && mMenuParent && !IsDisabled()) {
     // if this menu is a context menu it accepts right-clicks...fire away!

layout/xul/base/src/nsMenuPopupFrame.cpp

@@ -1422,3 +1422,12 @@ nsMenuPopupFrame::KillCloseTimer()
   }
   return NS_OK;
 }
+
+
+
+NS_IMETHODIMP
+nsMenuPopupFrame :: KillPendingTimers ( )
+{
+  return KillCloseTimer();
+
+} // KillPendingTimers

layout/xul/base/src/nsMenuPopupFrame.h

@@ -82,6 +82,8 @@ public:
   // Hides the chain of cascaded menus without closing them up.
   NS_IMETHOD HideChain();
 
+  NS_IMETHOD KillPendingTimers();
+
   NS_IMETHOD InstallKeyboardNavigator();
   NS_IMETHOD RemoveKeyboardNavigator();