dholbert: over in bug 1466897, i added the assert during nsCanvasFrame::DestroyFrom and it fails. It looks we don't null out the frame earlier because the link from the viewportframe and the canvasframe is already gone which causes us to not be able to find the root box in

dholbert: interestingly this also happens with the XUL code

bdahl: that is concerning

bdahl: I think I was wrong about the asserted condition -- I'll add a note on the bug