Bug 562740 combined nsMenuFrame::DoLayout and nsPopupSetFrame::DoLayout to create nsMenuPopupFrame::LayoutPopup.
nsMenuPopupFrame::LayoutPopup called SetPopupPosition with this (the nsMenuFrame) as the anchor and then laid out the menu popup frame. nsPopupSetFrame::DoLayout laid out the menu popup frame and then called SetPopupPosition with the anchor argument as null.
When these were combined into nsMenuPopupFrame::LayoutPopup both SetPopupPosition call were included, the second one always passing null for the anchor even though there may be a non-null anchor passed in from the caller.
This patch simply passes the passed in anchor frame to SetPopupPosition.