From 7984049da07d4a9ebb170922bc18bc5341ae6e93 Mon Sep 17 00:00:00 2001
From: Stephen A Pohl <spohl.mozilla.bugs@gmail.com>
Date: Mon, 5 Dec 2022 14:45:59 +0000
Subject: [PATCH] Bug 1663513: Add a null check to an existing assertion to
 prevent possible crashes related to popups and mouse events on Windows.
 r=cmartin

Differential Revision: https://phabricator.services.mozilla.com/D163515
---
 layout/xul/nsXULPopupManager.cpp | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/layout/xul/nsXULPopupManager.cpp b/layout/xul/nsXULPopupManager.cpp
index 683ceaee32c1..cbc2ad8e37cb 100644
--- a/layout/xul/nsXULPopupManager.cpp
+++ b/layout/xul/nsXULPopupManager.cpp
@@ -486,16 +486,18 @@ uint32_t nsXULPopupManager::GetSubmenuWidgetChain(
     if (!item->IsNoAutoHide()) {
       nsCOMPtr<nsIWidget> widget = item->Frame()->GetWidget();
       NS_ASSERTION(widget, "open popup has no widget");
-      aWidgetChain->AppendElement(widget.get());
-      // In the case when a menulist inside a panel is open, clicking in the
-      // panel should still roll up the menu, so if a different type is found,
-      // stop scanning.
-      if (!sameTypeCount) {
-        count++;
-        if (!parent ||
-            item->Frame()->PopupType() != parent->Frame()->PopupType() ||
-            item->IsContextMenu() != parent->IsContextMenu()) {
-          sameTypeCount = count;
+      if (widget) {
+        aWidgetChain->AppendElement(widget.get());
+        // In the case when a menulist inside a panel is open, clicking in the
+        // panel should still roll up the menu, so if a different type is found,
+        // stop scanning.
+        if (!sameTypeCount) {
+          count++;
+          if (!parent ||
+              item->Frame()->PopupType() != parent->Frame()->PopupType() ||
+              item->IsContextMenu() != parent->IsContextMenu()) {
+            sameTypeCount = count;
+          }
         }
       }
     }