Fix crash when we do a ReconstructDocElementHierarchy on a XUL document, which destroys the nsDocElementBoxFrame (which constructs the popupset) but not the nsRootBoxFrame. b=156719 r=waterson sr=ben a=asa

layout/xul/base/src/nsRootBoxFrame.cpp

@@ -289,9 +289,12 @@ nsRootBoxFrame::GetPopupSetFrame(nsIFrame** aResult)
 NS_IMETHODIMP
 nsRootBoxFrame::SetPopupSetFrame(nsIFrame* aPopupSet)
 {
-  NS_ASSERTION(!mPopupSetFrame, "Popup set is already defined! Only 1 allowed.");
+  // Under normal conditions this should only be called once.  However,
-  if (!mPopupSetFrame) 
+  // if something triggers ReconstructDocElementHierarchy, we will
-    mPopupSetFrame = aPopupSet;
+  // destroy this frame's child (the nsDocElementBoxFrame), but not this
+  // frame.  Since the anonymous content is associated with the
+  // nsDocElementBoxFrame, we'll get a new popupset.
+  mPopupSetFrame = aPopupSet;
   return NS_OK;
 }