I'm about to attach two related testcases. One makes Firefox crash [@ DoDeletingFrameSubtree] and the other makes it crash [@ nsFrame::BoxReflow]. Both crashes appear to be null derefs in both opt and debug builds. This might be related to bug 350460. Tested with non-Cocoa builds. ###!!! ASSERTION: wrong kind of child frame: 'aIsBlock == f->GetStyleDisplay()->IsBlockLevel()', file /Users/admin/trunk/mozilla/layout/generic/nsLineBox.cpp, line 73 ###!!! ASSERTION: How'd we get a floated inline frame? The frame ctor should've dealt with this.: 'aReflowState.mStyleDisplay->mFloats == NS_STYLE_FLOAT_NONE', file /Users/admin/trunk/mozilla/layout/generic/nsLineLayout.cpp, line 1236 ###!!! ASSERTION: Must be a box frame!: 'mScrollCornerBox->IsBoxFrame()', file /Users/admin/trunk/mozilla/layout/generic/nsGfxScrollFrame.cpp, line 2460 ###!!! ASSERTION: A box layout method was called but InitBoxMetrics was never called: 'metrics', file /Users/admin/trunk/mozilla/layout/generic/nsFrame.cpp, line 6166 ###!!! ASSERTION: Null out-of-flow for placeholder?: 'outOfFlow', file /Users/admin/trunk/mozilla/layout/base/../generic/nsPlaceholderFrame.h, line 164

There is a similar Sunbird crash on Windows after problems with xul popup menus, see Bug 364034. Duplicate?

For both testcases we get calls to RemoveMappingsForFrameSubtree from nsMenuFrame::DestroyPopupFrames while the pres shell is destroying so I'm pretty sure this is the same underlying cause as bug 372576. Neither testcase crashes trunk builds on Linux for some reason... they do crash Firefox 2.x and 1.5.x though.

WFM on trunk both before and after the patch for bug 372576.

Crashtests checked in.