Bug 296628. Don't crash when traversal is at the root and we try to go up. r+sr=bzbarsky,a=asa

layout/base/nsFrameTraversal.cpp

@@ -592,8 +592,8 @@ nsFocusIterator::Next()
        } else {
         parent = result;
         result = GetParentFrame(parent);
-        if (IsRootFrame(result)) {
-          result = 0;
+        if (!result || IsRootFrame(result)) {
+          result = nsnull;
           break;
         }
       }