Revalidate menu handle in mt.hTopMenu after DispatchMessage.

controls/menu.c

@@ -2907,6 +2907,12 @@ static INT MENU_TrackMenu( HMENU hmenu, UINT wFlags, INT x, INT y,
 
     ReleaseCapture();
 
+    /* If dropdown is still painted and the close box is clicked on
+       then the menu will be destroyed as part of the DispatchMessage above.
+       This will then invalidate the menu handle in mt.hTopMenu. We should
+       check for this first.  */
+    if( IsMenu( mt.hTopMenu ) )
+    {
 	menu = MENU_GetMenu( mt.hTopMenu );
 
         if( IsWindow( mt.hOwnerWnd ) )
@@ -2923,7 +2929,8 @@ static INT MENU_TrackMenu( HMENU hmenu, UINT wFlags, INT x, INT y,
         }
 
         /* Reset the variable for hiding menu */
-    menu->bTimeToHide = FALSE;
+        if( menu ) menu->bTimeToHide = FALSE;
+    }
 
     /* The return value is only used by TrackPopupMenu */
     return ((executedMenuId != -1) ? executedMenuId : 0);