Bug 501900, r+sr=roc, a=dveditz

git-svn-id: svn://10.0.0.236/trunk@258014 18797224-902f-48f8-a5cc-f745e15eee43

mozilla/layout/base/nsCSSFrameConstructor.cpp

@@ -13663,6 +13663,7 @@ nsCSSFrameConstructor::LazyGenerateChildrenEvent::Run()
   // this is hard-coded to handle only menu popup frames
   nsIFrame* frame = mPresShell->GetPrimaryFrameFor(mContent);
   if (frame && frame->GetType() == nsGkAtoms::menuPopupFrame) {
+    nsWeakFrame weakFrame(frame);
 #ifdef MOZ_XUL
     // it is possible that the frame is different than the one that requested
     // the lazy generation, but as long as it's a popup frame that hasn't
@@ -13700,7 +13701,7 @@ nsCSSFrameConstructor::LazyGenerateChildrenEvent::Run()
       fc->EndUpdate();
     }
 
-    if (mCallback)
+    if (mCallback && weakFrame.IsAlive())
       mCallback(mContent, frame, mArg);
 
     // call XBL constructors after the frames are created