Fix bug 326834 -- more care needed with listboxes. r+sr=roc

layout/base/nsCSSFrameConstructor.cpp

@@ -9330,13 +9330,19 @@ PRBool NotifyListBoxBody(nsPresContext*    aPresContext,
       nsIListBoxObject* listboxBody = listBoxObject->GetListBoxBody();
       if (listboxBody) {
         nsListBoxBodyFrame *listBoxBodyFrame = NS_STATIC_CAST(nsListBoxBodyFrame*, listboxBody);
-        if (aOperation == CONTENT_REMOVED)
-          listBoxBodyFrame->OnContentRemoved(aPresContext, aChildFrame, aIndexInContainer);
-        else
+        if (aOperation == CONTENT_REMOVED) {
+          // Except if we have an aChildFrame and its parent is not the right
+          // thing, then we don't do this.  Pseudo frames are so much fun....
+          if (!aChildFrame || aChildFrame->GetParent() == listBoxBodyFrame) {
+            listBoxBodyFrame->OnContentRemoved(aPresContext, aChildFrame,
+                                               aIndexInContainer);
+            return PR_TRUE;
+          }
+        } else {
           listBoxBodyFrame->OnContentInserted(aPresContext, aChild);
-        //NS_RELEASE(listBoxBodyFrame); frames aren't refcounted
+          return PR_TRUE;
+        }
       }
-      return PR_TRUE;
     }
   }
 

layout/xul/base/src/nsListBoxBodyFrame.cpp

@@ -1318,6 +1318,9 @@ nsListBoxBodyFrame::OnContentInserted(nsPresContext* aPresContext, nsIContent* a
 void
 nsListBoxBodyFrame::OnContentRemoved(nsPresContext* aPresContext, nsIFrame* aChildFrame, PRInt32 aIndex)
 {
+  NS_ASSERTION(!aChildFrame || aChildFrame->GetParent() == this,
+               "Removing frame that's not our child... Not good");
+  
   if (mRowCount >= 0)
     --mRowCount;
 
@@ -1436,7 +1439,12 @@ nsListBoxBodyFrame::RemoveChildFrame(nsBoxLayoutState &aState,
   nsCSSFrameConstructor* fc = presContext->PresShell()->FrameConstructor();
   fc->RemoveMappingsForFrameSubtree(aFrame);
 
-  mFrames.RemoveFrame(aFrame);
+#ifdef DEBUG
+  PRBool removed =
+#endif
+    mFrames.RemoveFrame(aFrame);
+  NS_ASSERTION(removed,
+               "Going to destroy a frame we didn't remove.  Prepare to crash");
   if (mLayoutManager)
     mLayoutManager->ChildrenRemoved(this, aState, aFrame);
   aFrame->Destroy(presContext);