Null check to avoid crashing on reentry to IncrementalScroll. (Bug 490461) r=roc a1.9.1.11=dveditz
authorMats Palmgren <matspal@gmail.com>
Mon, 14 Jun 2010 23:46:26 +0200
changeset 26951 4e407af7682f220b61324ad9399233f26502f16b
parent 26950 9b99125fac02680bb3ac741e87ec75439a022d5a
child 26952 24544966490cb6a8c3cf67e1c82dbe3c4b498a38
push id2389
push usermpalmgren@mozilla.com
push dateMon, 14 Jun 2010 21:47:03 +0000
reviewersroc
bugs490461
milestone1.9.1.11pre
Null check to avoid crashing on reentry to IncrementalScroll. (Bug 490461) r=roc a1.9.1.11=dveditz
view/src/nsScrollPortView.cpp
--- a/view/src/nsScrollPortView.cpp
+++ b/view/src/nsScrollPortView.cpp
@@ -721,17 +721,20 @@ nsScrollPortView::IncrementalScroll()
 
   nsWeakView thisView = this;
   if (mAsyncScroll->mIsSmoothScroll) {
     if (mAsyncScroll->mFrameIndex < SMOOTH_SCROLL_FRAMES) {
       ScrollToImpl(mOffsetX + mAsyncScroll->mVelocities[mAsyncScroll->mFrameIndex*2],
                    mOffsetY + mAsyncScroll->mVelocities[mAsyncScroll->mFrameIndex*2 + 1]);
       if (!thisView.IsAlive())
         return;
-      mAsyncScroll->mFrameIndex++;
+      // A nested ScrollTo() taking the synchronous path may have deleted
+      // |mAsyncScroll| so we need to null-check again.  Bug 490461.
+      if (mAsyncScroll)
+        mAsyncScroll->mFrameIndex++;
       return;
     }
   } else {
     ScrollToImpl(mDestinationX, mDestinationY);
     if (!thisView.IsAlive())
       return;
   }
   delete mAsyncScroll;