frame->PresContext()->GetRootPresContext() can return null for a popup that is
still in the menu chain. Bug 1876009 was a real crash from exactly that, in
RemoveMenuChainItem in this file: an open popup's pres shell gets destroyed, the
popup is still in the chain when its root pres context is requested, and the
fix was to null-check it. Every other caller here and in nsMenuPopupFrame.cpp
guards it; PaintPopups did not.
Also guard nsIWidget::GetWindowRenderer(). It deliberately returns null once
mShutdownObserver is gone, so that a LayerManager is not re-created during
shutdown, and renderer->AsFallback() derefs it unconditionally. No CID covers
that one.
Differential Revision: https://phabricator.services.mozilla.com/D324885
Sylvestre Ledru
b25967cc72