Bug 454751. Use a fresh nsFrameConstructorState when we construct new frames in ReconstructDocElementHierarchyInternal, so internal state pointing to deleted frames is flushed out. r+sr=bzbarsky

layout/base/crashtests/454751-1.xul

@@ -0,0 +1,20 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="addStyleSheet('window { display: table; }');">
+
+<script type="text/javascript">
+
+function addStyleSheet(text)
+{
+  var sheet = document.createElementNS("http://www.w3.org/1999/xhtml", "style");
+  sheet.appendChild(document.createTextNode(text));
+  document.documentElement.appendChild(sheet);
+}
+
+</script>
+
+<treecols/>
+
+</window>

layout/base/crashtests/crashtests.list

@@ -125,6 +125,7 @@ load 429088-2.html
 load 432752-1.svg
 load 433450-1.html
 load 444925-1.xul
+load 454751-1.xul
 load 455063-1.html
 load 455063-2.html
 load 455063-3.html

layout/base/nsCSSFrameConstructor.cpp

@@ -7683,20 +7683,27 @@ nsCSSFrameConstructor::ReconstructDocElementHierarchyInternal()
             return rv;
           }
         }
-        
-        mInitialContainingBlock = nsnull;
-        mRootElementStyleFrame = nsnull;
+      }
+    }
+    
+    if (rootContent && NS_SUCCEEDED(rv)) {
+      mInitialContainingBlock = nsnull;
+      mRootElementStyleFrame = nsnull;
 
-        // Create the new document element hierarchy
-        nsIFrame* newChild;
-        rv = ConstructDocElementFrame(state, rootContent,
-                                      mDocElementContainingBlock, &newChild);
+      // We don't reuse the old frame constructor state because,
+      // for example, its mPopupItems may be stale
+      nsFrameConstructorState state(mPresShell, mFixedContainingBlock,
+                                    nsnull, nsnull, mTempFrameTreeState);
 
-        // newChild could be null even if |rv| is success, thanks to XBL.
-        if (NS_SUCCEEDED(rv) && newChild) {
-          rv = state.mFrameManager->InsertFrames(mDocElementContainingBlock,
-                                                 nsnull, nsnull, newChild);
-        }
+      // Create the new document element hierarchy
+      nsIFrame* newChild;
+      rv = ConstructDocElementFrame(state, rootContent,
+                                    mDocElementContainingBlock, &newChild);
+
+      // newChild could be null even if |rv| is success, thanks to XBL.
+      if (NS_SUCCEEDED(rv) && newChild) {
+        rv = state.mFrameManager->InsertFrames(mDocElementContainingBlock,
+                                               nsnull, nsnull, newChild);
       }
     }
   }