Bug 391960, null check document of anchor node, r+sr=bz,a=damon

layout/xul/base/src/nsMenuPopupFrame.cpp

@@ -861,18 +861,20 @@ nsMenuPopupFrame::SetPopupPosition(nsIFrame* aAnchorFrame)
   if (!aAnchorFrame) {
     if (mAnchorContent) {
       nsCOMPtr<nsIDocument> document = mAnchorContent->GetDocument();
-      nsIPresShell *shell = document->GetPrimaryShell();
-      if (!shell)
-        return NS_ERROR_FAILURE;
-      
-      aAnchorFrame = shell->GetPrimaryFrameFor(mAnchorContent);
-    }
-    else {
-      aAnchorFrame = presContext->PresShell()->FrameManager()->GetRootFrame();
+      if (document) {
+        nsIPresShell *shell = document->GetPrimaryShell();
+        if (!shell)
+          return NS_ERROR_FAILURE;
+
+        aAnchorFrame = shell->GetPrimaryFrameFor(mAnchorContent);
+      }
     }
 
-    if (!aAnchorFrame)
-      return NS_OK;
+    if (!aAnchorFrame) {
+      aAnchorFrame = presContext->PresShell()->FrameManager()->GetRootFrame();
+      if (!aAnchorFrame)
+        return NS_OK;
+    }
   }
 
   if (aAnchorFrame->GetContent()) {