Fix null pointer bugs (35785 and nonfiled), fixes editor bug 35885. r=evaughan

layout/xul/base/src/nsMenuFrame.cpp

@@ -1477,6 +1477,8 @@ nsMenuFrame::GetPrefSize(nsBoxLayoutState& aState, nsSize& aSize)
         if (!frame) {
           MarkAsGenerated();
           frame = mPopupFrames.FirstChild();
+          // No child - just return
+          if (!frame) return NS_OK;
         }
       
         nsIBox* ibox = nsnull;

layout/xul/base/src/nsTempleLayout.cpp

@@ -147,21 +147,22 @@ nsTempleLayout::BuildBoxSizeList(nsIBox* aBox, nsBoxLayoutState& aState, nsBoxSi
   while(box) {
     nsIMonument* monument = nsnull;
     box->GetLayoutManager(getter_AddRefs(layout));
-    layout->QueryInterface(NS_GET_IID(nsIMonument), (void**)&monument);
-    
-    if (monument) 
-         monument->BuildBoxSizeList(box, aState, first, last);
-    else {
-         nsMonumentLayout::BuildBoxSizeList(box, aState, first, last);
-         first->bogus = PR_TRUE;
+
+    if (layout) {
+      layout->QueryInterface(NS_GET_IID(nsIMonument), (void**)&monument);
+      if (monument) 
+           monument->BuildBoxSizeList(box, aState, first, last);
+      else {
+           nsMonumentLayout::BuildBoxSizeList(box, aState, first, last);
+           first->bogus = PR_TRUE;
+      }
+
+      if (count == 0)
+        aFirst = first;
+      else 
+        (aLast)->next = first;
+      aLast = last;
     }
-
-    if (count == 0)
-      aFirst = first;
-    else 
-      (aLast)->next = first;
-
-    aLast = last;
     
     box->GetNextBox(&box);
     count++;