Keep pres shell alive during ProcessRestyledFrames. (Bug 462392) r+sr=bzbarsky
authorL. David Baron <dbaron@dbaron.org>
Sun, 02 Nov 2008 11:44:55 -0800
changeset 21202 5785b70454d3d3cd5342808d451d034a3187f81a
parent 21201 6e68a0d025c61cc6115ec70a7f6743de512a65d2
child 21203 01406b3b31c01cc3b1da28d36c8c3bc8498ba9ad
push id3401
push userdbaron@mozilla.com
push dateSun, 02 Nov 2008 19:45:27 +0000
treeherdermozilla-central@01406b3b31c0 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs462392
milestone1.9.1b2pre
Keep pres shell alive during ProcessRestyledFrames. (Bug 462392) r+sr=bzbarsky
layout/base/nsCSSFrameConstructor.cpp
layout/base/nsPresShell.cpp
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -13262,16 +13262,20 @@ nsCSSFrameConstructor::RebuildAllStyleDa
                "Should not reconstruct the root of the frame tree.  "
                "Use ReconstructDocElementHierarchy instead.");
 
   mRebuildAllStyleData = PR_FALSE;
 
   if (!mPresShell || !mPresShell->GetRootFrame())
     return;
 
+  // Processing the style changes could cause a flush that propagates to
+  // the parent frame and thus destroys the pres shell.
+  nsCOMPtr<nsIPresShell> kungFuDeathGrip(mPresShell);
+
   // Tell the style set to get the old rule tree out of the way
   // so we can recalculate while maintaining rule tree immutability
   nsresult rv = mPresShell->StyleSet()->BeginReconstruct();
   if (NS_FAILED(rv))
     return;
 
   // Recalculate all of the style contexts for the document
   // Note that we can ignore the return value of ComputeStyleChangeFor
--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@@ -2632,16 +2632,17 @@ PresShell::FireResizeEvent()
 
   //Send resize event from here.
   nsEvent event(PR_TRUE, NS_RESIZE_EVENT);
   nsEventStatus status = nsEventStatus_eIgnore;
 
   nsPIDOMWindow *window = mDocument->GetWindow();
   if (window) {
     nsEventDispatcher::Dispatch(window, mPresContext, &event, nsnull, &status);
+    // |this| may now be destroyed
   }
 }
 
 NS_IMETHODIMP
 PresShell::SetIgnoreFrameDestruction(PRBool aIgnore)
 {
   mIgnoreFrameDestruction = aIgnore;
   return NS_OK;