Bug 1420547: Fix removal of <area> elements from an image map. r=bz

This code was relying on nsImageFrame::ContentRemoved running before it.

MozReview-Commit-ID: Imjhd9exjQS

--HG--
extra : rebase_source : 7c6367f515dc140176e50d959c07250057e28354

layout/base/nsCSSFrameConstructor.cpp

@@ -8438,6 +8438,7 @@ nsCSSFrameConstructor::ContentRemoved(nsIContent* aContainer,
   if (!childFrame || childFrame->GetContent() != aChild) {
     // XXXbz the GetContent() != aChild check is needed due to bug 135040.
     // Remove it once that's fixed.
+    childFrame = nullptr;
     UnregisterDisplayNoneStyleFor(aChild, aContainer);
   }
   MOZ_ASSERT(!childFrame || !GetDisplayContentsStyleFor(aChild),