nsListControlFrame::CountOptionsAndOptgroups walked the frame tree to count rows, checking each content to determine if it was an option element. It can instead walk the DOM to get the same info. By counting frames it became yet-another copy of the option list traversal, and had the same issue around deeply traversing option lists due to parser relaxation. This change moves more of the option list traversal code into HTMLSelectElement, and calls out to it in nsListControlFrame. Differential Revision: https://phabricator.services.mozilla.com/D323013