diff --git a/layout/base/crashtests/569018-1.html b/layout/base/crashtests/569018-1.html
new file mode 100644
index 00000000000..557787f66d3
--- /dev/null
+++ b/layout/base/crashtests/569018-1.html
@@ -0,0 +1,17 @@
+
+
+
+
+
+
+
+
diff --git a/layout/base/crashtests/crashtests.list b/layout/base/crashtests/crashtests.list
index 3f3dd7c94b2..eb78484f5bc 100644
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -302,5 +302,6 @@ load 560441-1.xhtml
load 560447-1.html
load 564063-1.html
load 567292-1.xhtml
+load 569018-1.html
load 572003.xul
load 572582-1.xhtml
diff --git a/layout/base/nsCSSFrameConstructor.cpp b/layout/base/nsCSSFrameConstructor.cpp
index f37d1a959a7..38df4ca4e96 100644
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -5514,6 +5514,13 @@ nsCSSFrameConstructor::GetFrameFor(nsIContent* aContent)
if (!frame)
return nsnull;
+ // If the content of the frame is not the desired content then this is not
+ // really a frame for the desired content.
+ // XXX This check is needed due to bug 135040. Remove it once that's fixed.
+ if (frame->GetContent() != aContent) {
+ return nsnull;
+ }
+
nsIFrame* insertionFrame = frame->GetContentInsertionFrame();
NS_ASSERTION(insertionFrame == frame || !frame->IsLeaf(),
@@ -6256,11 +6263,6 @@ nsCSSFrameConstructor::MaybeConstructLazily(Operation aOperation,
// Walk up the tree setting the NODE_DESCENDANTS_NEED_FRAMES bit as we go.
nsIContent* content = aContainer;
#ifdef DEBUG
- // We have to jump through hoops so that we can make some reasonable asserts
- // due to bug 135040. We detect if we find a bogus primary frame (I'm looking
- // at you, areas), and relax our assertions for the remaining ancestors.
- PRBool bogusPrimaryFrame = PR_FALSE;
-
// If we hit a node with no primary frame, or the NODE_NEEDS_FRAME bit set
// we want to assert, but leaf frames that process their own children and may
// ignore anonymous children (eg framesets) make this complicated. So we set
@@ -6275,15 +6277,10 @@ nsCSSFrameConstructor::MaybeConstructLazily(Operation aOperation,
if (content->GetPrimaryFrame() && content->GetPrimaryFrame()->IsLeaf()) {
noPrimaryFrame = needsFrameBitSet = PR_FALSE;
}
- if (!bogusPrimaryFrame && content->GetPrimaryFrame() &&
- content->GetPrimaryFrame()->GetContent() != content) {
- bogusPrimaryFrame = PR_TRUE;
- }
- if (!noPrimaryFrame && !content->GetPrimaryFrame() && !bogusPrimaryFrame) {
+ if (!noPrimaryFrame && !content->GetPrimaryFrame()) {
noPrimaryFrame = PR_TRUE;
}
- if (!needsFrameBitSet && content->HasFlag(NODE_NEEDS_FRAME) &&
- !bogusPrimaryFrame) {
+ if (!needsFrameBitSet && content->HasFlag(NODE_NEEDS_FRAME)) {
needsFrameBitSet = PR_TRUE;
}
#endif