Bug 536720 - Don't say the frame is in the nsGkAtoms::popupList if that list is empty. r=fantasai

layout/base/crashtests/536720.xul

@@ -0,0 +1,23 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<script type="text/javascript">
+<![CDATA[
+
+function boom()
+{
+  var menupopup = document.getElementById("menupopup");
+  menupopup.parentNode.removeChild(menupopup);
+}
+window.addEventListener("load", boom, false);
+
+]]>
+</script>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><menulist><menupopup id="menupopup"/>
+T
+</menulist></window>
+
+</window>

layout/base/crashtests/540760.xul

@@ -0,0 +1,18 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<script>
+
+function boom()
+{
+  var a = document.getElementById("a");
+  while (a.firstChild)
+    a.removeChild(a.firstChild);
+}
+
+window.addEventListener("load", boom, false);
+
+</script>
+
+<menulist id="a" sizetopopup="pref"><menupopup/><menupopup/></menulist>
+
+</window>

layout/base/crashtests/572003.xul

@@ -0,0 +1,3 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="var p=document.getElementById('p'); for(var i=0;i!=3;++i)p.parentNode.appendChild(p);">
+<menuitem style="counter-reset: chicken;">P<popup id="p" style="counter-reset: chicken;"/></menuitem>
+</window>

layout/base/crashtests/crashtests.list

@@ -284,16 +284,19 @@ load 534367-1.xhtml
 load 535721-1.xhtml
 load 535911-1.xhtml
 load 536623-1.xhtml
+load 536720.xul
 load 537059-1.xhtml
 load 537141-1.xhtml
 load 537562-1.xhtml
 load 538082-1.xul
 load 538207-1.xhtml
 load 538210-1.html
+load 540760.xul
 load 541869-1.xhtml
 load 541869-2.html
 load 560441-1.xhtml
 load 560447-1.html
 load 564063-1.html
 load 567292-1.xhtml
+load 572003.xul
 load 572582-1.xhtml

layout/base/nsLayoutUtils.cpp

@@ -248,9 +248,7 @@ nsLayoutUtils::GetChildListNameFor(nsIFrame* aChildFrame)
                              : nsnull;
       NS_ASSERTION(!firstPopup || !firstPopup->GetNextSibling(),
                    "We assume popupList only has one child, but it has more.");
-      listName = (!firstPopup || firstPopup == aChildFrame)
+      listName = firstPopup == aChildFrame ? nsGkAtoms::popupList : nsnull;
-                 ? nsGkAtoms::popupList
-                 : nsnull;
     } else if (nsGkAtoms::tableColGroupFrame == childType) {
       listName = nsGkAtoms::colGroupList;
     } else if (nsGkAtoms::tableCaptionFrame == aChildFrame->GetType()) {