window: Fix use-after-free in menu button handler

Commit d2fbb3870cfaea623a87ba28c9587676bbdc93f7 introduced a use-after-free
error in the case where we destroy the menu.

diff --git a/clients/window.c b/clients/window.c
index d5a14dd..fe968ed 100644 (file)
--- a/clients/window.c
+++ b/clients/window.c
@@ -3363,10 +3363,9 @@ menu_button_handler(struct widget *widget,
                           menu->current, menu->window->parent->user_data);
                input_ungrab(input);
                menu_destroy(menu);
-       }
-
-       if (state == WL_POINTER_BUTTON_STATE_RELEASED)
+       } else if (state == WL_POINTER_BUTTON_STATE_RELEASED) {
                menu->release_count++;
+       }
 }
 
 static void