[0.4.11] [WIN32K:NTUSER] Reference menus owned by a popup menu. CORE-15504

Fixes a BSOD mentioned in CORE-15504

cherry picked from commit 0.4.12-dev-218-g
e3c8002

Author: ThFabba

win32ss/user/ntuser/menu.c

@@ -4504,6 +4504,10 @@ PopupMenuWndProc(
       {
         CREATESTRUCTW *cs = (CREATESTRUCTW *) lParam;
         pPopupMenu->spmenu = UserGetMenuObject(cs->lpCreateParams);
+        if (pPopupMenu->spmenu)
+        {
+           UserReferenceObject(pPopupMenu->spmenu);
+        }
         break;
       }
 
@@ -4548,6 +4552,10 @@ PopupMenuWndProc(
 
     case WM_NCDESTROY:
       {
+         if (pPopupMenu->spmenu)
+         {
+            IntReleaseMenuObject(pPopupMenu->spmenu);
+         }
          DesktopHeapFree(Wnd->head.rpdesk, pPopupMenu );
          ((PMENUWND)Wnd)->ppopupmenu = 0;
          Wnd->fnid = FNID_DESTROY;
@@ -4563,6 +4571,11 @@ PopupMenuWndProc(
            ERR("Bad Menu Handle\n");
            break;
         }
+        UserReferenceObject(pmenu);
+        if (pPopupMenu->spmenu)
+        {
+           IntReleaseMenuObject(pPopupMenu->spmenu);
+        }
         pPopupMenu->spmenu = pmenu;
         break;
       }