From ca51ca58490eb668eb091513f401f758dbad3024 Mon Sep 17 00:00:00 2001
From: Mats Palmgren <matspal@gmail.com>
Date: Sun, 27 Jun 2010 22:53:59 +0200
Subject: [PATCH] Bug 536720 - Don't say the frame is in the
 nsGkAtoms::popupList if that list is empty.  r=fantasai

---
 layout/base/crashtests/536720.xul      | 23 +++++++++++++++++++++++
 layout/base/crashtests/540760.xul      | 18 ++++++++++++++++++
 layout/base/crashtests/572003.xul      |  3 +++
 layout/base/crashtests/crashtests.list |  3 +++
 layout/base/nsLayoutUtils.cpp          |  4 +---
 5 files changed, 48 insertions(+), 3 deletions(-)
 create mode 100644 layout/base/crashtests/536720.xul
 create mode 100644 layout/base/crashtests/540760.xul
 create mode 100644 layout/base/crashtests/572003.xul

diff --git a/layout/base/crashtests/536720.xul b/layout/base/crashtests/536720.xul
new file mode 100644
index 000000000000..2b8c0b614377
--- /dev/null
+++ b/layout/base/crashtests/536720.xul
@@ -0,0 +1,23 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<script type="text/javascript">
+<![CDATA[
+
+function boom()
+{
+  var menupopup = document.getElementById("menupopup");
+  menupopup.parentNode.removeChild(menupopup);
+}
+window.addEventListener("load", boom, false);
+
+]]>
+</script>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><menulist><menupopup id="menupopup"/>
+T
+</menulist></window>
+
+</window>
diff --git a/layout/base/crashtests/540760.xul b/layout/base/crashtests/540760.xul
new file mode 100644
index 000000000000..b0e857ec9fc6
--- /dev/null
+++ b/layout/base/crashtests/540760.xul
@@ -0,0 +1,18 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<script>
+
+function boom()
+{
+  var a = document.getElementById("a");
+  while (a.firstChild)
+    a.removeChild(a.firstChild);
+}
+
+window.addEventListener("load", boom, false);
+
+</script>
+
+<menulist id="a" sizetopopup="pref"><menupopup/><menupopup/></menulist>
+
+</window>
diff --git a/layout/base/crashtests/572003.xul b/layout/base/crashtests/572003.xul
new file mode 100644
index 000000000000..10488fc6462c
--- /dev/null
+++ b/layout/base/crashtests/572003.xul
@@ -0,0 +1,3 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="var p=document.getElementById('p'); for(var i=0;i!=3;++i)p.parentNode.appendChild(p);">
+<menuitem style="counter-reset: chicken;">P<popup id="p" style="counter-reset: chicken;"/></menuitem>
+</window>
diff --git a/layout/base/crashtests/crashtests.list b/layout/base/crashtests/crashtests.list
index 5ab1dfebdbf3..9b6996f61353 100644
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -284,16 +284,19 @@ load 534367-1.xhtml
 load 535721-1.xhtml
 load 535911-1.xhtml
 load 536623-1.xhtml
+load 536720.xul
 load 537059-1.xhtml
 load 537141-1.xhtml
 load 537562-1.xhtml
 load 538082-1.xul
 load 538207-1.xhtml
 load 538210-1.html
+load 540760.xul
 load 541869-1.xhtml
 load 541869-2.html
 load 560441-1.xhtml
 load 560447-1.html
 load 564063-1.html
 load 567292-1.xhtml
+load 572003.xul
 load 572582-1.xhtml
diff --git a/layout/base/nsLayoutUtils.cpp b/layout/base/nsLayoutUtils.cpp
index 5ec5d5520676..c092795532fb 100644
--- a/layout/base/nsLayoutUtils.cpp
+++ b/layout/base/nsLayoutUtils.cpp
@@ -248,9 +248,7 @@ nsLayoutUtils::GetChildListNameFor(nsIFrame* aChildFrame)
                              : nsnull;
       NS_ASSERTION(!firstPopup || !firstPopup->GetNextSibling(),
                    "We assume popupList only has one child, but it has more.");
-      listName = (!firstPopup || firstPopup == aChildFrame)
-                 ? nsGkAtoms::popupList
-                 : nsnull;
+      listName = firstPopup == aChildFrame ? nsGkAtoms::popupList : nsnull;
     } else if (nsGkAtoms::tableColGroupFrame == childType) {
       listName = nsGkAtoms::colGroupList;
     } else if (nsGkAtoms::tableCaptionFrame == aChildFrame->GetType()) {