Comment 6 for bug 1158358

Here is where the crash is happening:

    void WebPage::hidePopupMenu()
    {
        if (!m_activePopupMenu)
            return;

        m_activePopupMenu->client()->popupDidHide();
        m_activePopupMenu = 0;
    }

m_activePopupMenu->client() returns m_activePopupMenu->m_popupClient, which in this case is null. It looks like the popup client is destroyed too early.