Do IsProperAncestorFrame check before destroying floats, but not for popups. (Bug 588158) r=dbaron a2.0=blocking

layout/generic/nsPlaceholderFrame.cpp

@@ -163,7 +163,7 @@ nsPlaceholderFrame::DestroyFrom(nsIFrame* aDestructRoot)
     // then call RemoveFrame on it here.
     // Also destroy it here if it's a popup frame. (Bug 96291)
     if (shell->FrameManager() &&
-        ((GetStateBits() & PLACEHOLDER_FOR_FLOAT) ||
+        ((GetStateBits() & PLACEHOLDER_FOR_POPUP) ||
          !nsLayoutUtils::IsProperAncestorFrame(aDestructRoot, oof))) {
       nsIAtom* listName = nsLayoutUtils::GetChildListNameFor(oof);
       shell->FrameManager()->RemoveFrame(listName, oof);