backing out the previous patch, becaused qm-centos5-01 dep unit test is orange
authormasayuki@d-toybox.com
Thu, 28 Feb 2008 05:59:25 -0800
changeset 12391 b46e48ef8e4dd693085ebdc0f83a6976deb69a86
parent 12390 c087c8c261d8c38f427c65194e5a161230ff541c
child 12392 0c25838038ae8e4b8b8a610843a9c2cdae99d85b
push idunknown
push userunknown
push dateunknown
milestone1.9b4pre
backing out the previous patch, becaused qm-centos5-01 dep unit test is orange
accessible/src/html/nsHyperTextAccessible.cpp
content/base/public/nsISelectionController.idl
content/events/src/nsEventListenerManager.cpp
editor/composer/src/nsEditorSpellCheck.cpp
editor/libeditor/base/nsEditor.cpp
editor/libeditor/html/nsHTMLDataTransfer.cpp
editor/libeditor/text/nsEditorEventListeners.cpp
editor/libeditor/text/nsPlaintextDataTransfer.cpp
editor/txtsvc/src/nsTextServicesDocument.cpp
embedding/components/find/src/nsWebBrowserFind.cpp
extensions/spellcheck/src/mozSpellChecker.cpp
layout/base/nsPresShell.cpp
layout/forms/nsTextControlFrame.cpp
layout/generic/nsSelection.cpp
toolkit/components/typeaheadfind/src/nsTypeAheadFind.cpp
--- a/accessible/src/html/nsHyperTextAccessible.cpp
+++ b/accessible/src/html/nsHyperTextAccessible.cpp
@@ -1475,20 +1475,18 @@ nsresult nsHyperTextAccessible::SetSelec
     for (PRInt32 count = 0; count < numRanges - 1; count ++) {
       nsCOMPtr<nsIDOMRange> range;
       domSel->GetRangeAt(1, getter_AddRefs(range));
       domSel->RemoveRange(range);
     }
   }
   
   if (selCon) {
-    // XXX I'm not sure this can do synchronous scrolling. If the last param is
-    // set to true, this calling might flush the pending reflow. See bug 418470.
     selCon->ScrollSelectionIntoView(nsISelectionController::SELECTION_NORMAL,
-      nsISelectionController::SELECTION_FOCUS_REGION, PR_FALSE);
+       nsISelectionController::SELECTION_FOCUS_REGION, PR_FALSE);
   }
 
   return NS_OK;
 }
 
 NS_IMETHODIMP nsHyperTextAccessible::SetCaretOffset(PRInt32 aCaretOffset)
 {
   return SetSelectionRange(aCaretOffset, aCaretOffset);
--- a/content/base/public/nsISelectionController.idl
+++ b/content/base/public/nsISelectionController.idl
@@ -97,19 +97,16 @@ interface nsISelectionController : nsISe
    * ScrollSelectionIntoView scrolls a region of the selection,
    * so that it is visible in the scrolled view.
    *
    * @param aType the selection to scroll into view. //SelectionType
    * @param aRegion the region inside the selection to scroll into view. //SelectionRegion
    * @param aIsSynchronous when true, scrolls the selection into view
    * before returning. If false, posts a request which is processed
    * at some point after the method returns.
-   *
-   * Note that if isSynchronous is true, then this might flush the pending
-   * reflow. It's dangerous for some objects. See bug 418470 comment 12.
    */
     void scrollSelectionIntoView(in short type, in short region, in boolean isSynchronous);
    /**
    * RepaintSelection repaints the selection specified by aType.
    *
    * @param aType specifies the selection to repaint.
    */
     void repaintSelection(in short type);
--- a/content/events/src/nsEventListenerManager.cpp
+++ b/content/events/src/nsEventListenerManager.cpp
@@ -1113,18 +1113,16 @@ nsEventListenerManager::HandleEvent(nsPr
   }
 
   //Set the value of the internal PreventDefault flag properly based on aEventStatus
   if (*aEventStatus == nsEventStatus_eConsumeNoDefault) {
     aEvent->flags |= NS_EVENT_FLAG_NO_DEFAULT;
   }
   PRUint16 currentGroup = aFlags & NS_EVENT_FLAG_SYSTEM_EVENT;
 
-  // Beware! This may flush notifications via synchronous
-  // ScrollSelectionIntoView.
   if (aEvent->message == NS_CONTEXTMENU &&
       NS_FAILED(FixContextMenuEvent(aPresContext, aCurrentTarget, aEvent,
                                     aDOMEvent))) {
     NS_WARNING("failed to fix context menu event target");
   }
 
   const EventTypeData* typeData = nsnull;
   const EventDispatchData* dispData = nsnull;
@@ -1377,18 +1375,16 @@ nsEventListenerManager::FixContextMenuEv
     }
     ret = NS_NewDOMMouseEvent(aDOMEvent, aPresContext, static_cast<nsInputEvent*>(aEvent));
     NS_ENSURE_SUCCESS(ret, ret);
   }
 
   // see if we should use the caret position for the popup
   if (contextMenuKey) {
     nsPoint caretPoint;
-    // Beware! This may flush notifications via synchronous
-    // ScrollSelectionIntoView.
     if (PrepareToUseCaretPosition(((nsGUIEvent*)aEvent)->widget,
                                   shell, caretPoint)) {
       // caret position is good
       aEvent->refPoint.x = caretPoint.x;
       aEvent->refPoint.y = caretPoint.y;
       return NS_OK;
     }
   }
@@ -1506,18 +1502,16 @@ nsEventListenerManager::PrepareToUseCare
   // the correct menu at a weird place than the wrong menu.
   nsCOMPtr<nsISelectionController> selCon;
   if (frame)
     frame->GetSelectionController(aShell->GetPresContext(),
                                   getter_AddRefs(selCon));
   else
     selCon = do_QueryInterface(aShell);
   if (selCon) {
-    // After ScrollSelectionIntoView(), the pending notifications might be
-    // flushed and PresShell/PresContext/Frames may be dead. See bug 418470.
     rv = selCon->ScrollSelectionIntoView(nsISelectionController::SELECTION_NORMAL,
         nsISelectionController::SELECTION_FOCUS_REGION, PR_TRUE);
     NS_ENSURE_SUCCESS(rv, PR_FALSE);
   }
 
   // get caret position relative to some view (normally the same as the
   // event widget view, but this is not guaranteed)
   PRBool isCollapsed;
--- a/editor/composer/src/nsEditorSpellCheck.cpp
+++ b/editor/composer/src/nsEditorSpellCheck.cpp
@@ -242,18 +242,16 @@ NS_IMETHODIMP
 nsEditorSpellCheck::GetNextMisspelledWord(PRUnichar **aNextMisspelledWord)
 {
   if (!mSpellChecker)
     return NS_ERROR_NOT_INITIALIZED;
 
   nsAutoString nextMisspelledWord;
   
   DeleteSuggestedWordList();
-  // Beware! This may flush notifications via synchronous
-  // ScrollSelectionIntoView.
   nsresult rv = mSpellChecker->NextMisspelledWord(nextMisspelledWord,
                                                   &mSuggestedWordList);
 
   *aNextMisspelledWord = ToNewUnicode(nextMisspelledWord);
   return rv;
 }
 
 NS_IMETHODIMP    
--- a/editor/libeditor/base/nsEditor.cpp
+++ b/editor/libeditor/base/nsEditor.cpp
@@ -986,19 +986,16 @@ nsEditor::EndPlaceHolderTransaction()
    // See bugs 35296 and 199412.
     if (selPrivate) {
       selPrivate->SetCanCacheFrameOffset(PR_TRUE);
     }
     
     // time to turn off the batch
     EndUpdateViewBatch();
     // make sure selection is in view
-
-    // After ScrollSelectionIntoView(), the pending notifications might be
-    // flushed and PresShell/PresContext/Frames may be dead. See bug 418470.
     ScrollSelectionIntoView(PR_FALSE);
 
     // cached for frame offset are Not available now
     if (selPrivate) {
       selPrivate->SetCanCacheFrameOffset(PR_FALSE);
     }
 
     if (mSelState)
@@ -2558,18 +2555,16 @@ NS_IMETHODIMP nsEditor::ScrollSelectionI
     {
       // If the editor is relying on asynchronous reflows, we have
       // to use asynchronous requests to scroll, so that the scrolling happens
       // after reflow requests are processed.
       // XXXbz why not just always do async scroll?
       syncScroll = !(flags & nsIPlaintextEditor::eEditorUseAsyncUpdatesMask);
     }
 
-    // After ScrollSelectionIntoView(), the pending notifications might be
-    // flushed and PresShell/PresContext/Frames may be dead. See bug 418470.
     selCon->ScrollSelectionIntoView(nsISelectionController::SELECTION_NORMAL,
                                     region, syncScroll);
   }
 
   return NS_OK;
 }
 
 NS_IMETHODIMP nsEditor::InsertTextImpl(const nsAString& aStringToInsert, 
--- a/editor/libeditor/html/nsHTMLDataTransfer.cpp
+++ b/editor/libeditor/html/nsHTMLDataTransfer.cpp
@@ -1434,19 +1434,16 @@ NS_IMETHODIMP nsHTMLEditor::InsertFromTr
                                      aDestinationNode, aDestOffset,
                                      aDoDeleteSelection);
         }
       }
     }
   }
       
   // Try to scroll the selection into view if the paste/drop succeeded
-
-  // After ScrollSelectionIntoView(), the pending notifications might be
-  // flushed and PresShell/PresContext/Frames may be dead. See bug 418470.
   if (NS_SUCCEEDED(rv))
     ScrollSelectionIntoView(PR_FALSE);
 
   return rv;
 }
 
 NS_IMETHODIMP nsHTMLEditor::InsertFromDrop(nsIDOMEvent* aDropEvent)
 {
@@ -1665,18 +1662,16 @@ NS_IMETHODIMP nsHTMLEditor::InsertFromDr
       // We have to figure out whether to delete/relocate caret only once
       doPlaceCaret = PR_FALSE;
     }
     
     // handle transferable hooks
     if (!nsEditorHookUtils::DoInsertionHook(domdoc, aDropEvent, trans))
       return NS_OK;
 
-    // Beware! This may flush notifications via synchronous
-    // ScrollSelectionIntoView.
     rv = InsertFromTransferable(trans, srcdomdoc, contextStr, infoStr,
                                 newSelectionParent,
                                 newSelectionOffset, deleteSelection);
   }
 
   return rv;
 }
 
@@ -1887,18 +1882,16 @@ NS_IMETHODIMP nsHTMLEditor::Paste(PRInt3
       }
 
       // handle transferable hooks
       nsCOMPtr<nsIDOMDocument> domdoc;
       GetDocument(getter_AddRefs(domdoc));
       if (!nsEditorHookUtils::DoInsertionHook(domdoc, nsnull, trans))
         return NS_OK;
 
-      // Beware! This may flush notifications via synchronous
-      // ScrollSelectionIntoView.
       rv = InsertFromTransferable(trans, nsnull, contextStr, infoStr,
                                   nsnull, 0, PR_TRUE);
     }
   }
 
   return rv;
 }
 
@@ -1920,18 +1913,16 @@ NS_IMETHODIMP nsHTMLEditor::PasteNoForma
   nsCOMPtr<nsITransferable> trans;
   rv = nsPlaintextEditor::PrepareTransferable(getter_AddRefs(trans));
   if (NS_SUCCEEDED(rv) && trans)
   {
     // Get the Data from the clipboard  
     if (NS_SUCCEEDED(clipboard->GetData(trans, aSelectionType)) && IsModifiable())
     {
       const nsAFlatString& empty = EmptyString();
-      // Beware! This may flush notifications via synchronous
-      // ScrollSelectionIntoView.
       rv = InsertFromTransferable(trans, nsnull, empty, empty, nsnull, 0,
                                   PR_TRUE);
     }
   }
 
   return rv;
 }
 
--- a/editor/libeditor/text/nsEditorEventListeners.cpp
+++ b/editor/libeditor/text/nsEditorEventListeners.cpp
@@ -667,18 +667,16 @@ nsTextEditorDragListener::DragDrop(nsIDO
       // editfields if that is what is desired.
       return aMouseEvent->StopPropagation();
     }
     return NS_OK;
   }
 
   aMouseEvent->StopPropagation();
   aMouseEvent->PreventDefault();
-  // Beware! This may flush notifications via synchronous
-  // ScrollSelectionIntoView.
   return mEditor->InsertFromDrop(aMouseEvent);
 }
 
 nsresult
 nsTextEditorDragListener::Drag(nsIDOMEvent* aDragEvent)
 {
   return NS_OK;
 }
--- a/editor/libeditor/text/nsPlaintextDataTransfer.cpp
+++ b/editor/libeditor/text/nsPlaintextDataTransfer.cpp
@@ -131,19 +131,16 @@ NS_IMETHODIMP nsPlaintextEditor::InsertT
       NS_ASSERTION(stuffToPaste.Length() <= (len/2), "Invalid length!");
       nsAutoEditBatch beginBatching(this);
       rv = InsertTextAt(stuffToPaste, aDestinationNode, aDestOffset, aDoDeleteSelection);
     }
   }
   NS_Free(bestFlavor);
       
   // Try to scroll the selection into view if the paste/drop succeeded
-
-  // After ScrollSelectionIntoView(), the pending notifications might be flushed
-  // and PresShell/PresContext/Frames may be dead. See bug 418470.
   if (NS_SUCCEEDED(rv))
     ScrollSelectionIntoView(PR_FALSE);
 
   return rv;
 }
 
 NS_IMETHODIMP nsPlaintextEditor::InsertFromDrop(nsIDOMEvent* aDropEvent)
 {
@@ -299,18 +296,16 @@ NS_IMETHODIMP nsPlaintextEditor::InsertF
   {
     rv = dragSession->GetData(trans, i);
     if (NS_FAILED(rv)) return rv;
     if (!trans) return NS_OK; // NS_ERROR_FAILURE; Should we fail?
 
     if (!nsEditorHookUtils::DoInsertionHook(destdomdoc, aDropEvent, trans))
       return NS_OK;
 
-    // Beware! This may flush notifications via synchronous
-    // ScrollSelectionIntoView.
     rv = InsertTextFromTransferable(trans, newSelectionParent, newSelectionOffset, deleteSelection);
   }
 
   return rv;
 }
 
 NS_IMETHODIMP nsPlaintextEditor::CanDrag(nsIDOMEvent *aDragEvent, PRBool *aCanDrag)
 {
@@ -450,18 +445,16 @@ NS_IMETHODIMP nsPlaintextEditor::Paste(P
     if (NS_SUCCEEDED(clipboard->GetData(trans, aSelectionType)) && IsModifiable())
     {
       // handle transferable hooks
       nsCOMPtr<nsIDOMDocument> domdoc;
       GetDocument(getter_AddRefs(domdoc));
       if (!nsEditorHookUtils::DoInsertionHook(domdoc, nsnull, trans))
         return NS_OK;
 
-      // Beware! This may flush notifications via synchronous
-      // ScrollSelectionIntoView.
       rv = InsertTextFromTransferable(trans, nsnull, nsnull, PR_TRUE);
     }
   }
 
   return rv;
 }
 
 
--- a/editor/txtsvc/src/nsTextServicesDocument.cpp
+++ b/editor/txtsvc/src/nsTextServicesDocument.cpp
@@ -1826,18 +1826,16 @@ nsTextServicesDocument::ScrollSelectionI
 {
   nsresult result;
 
   if (!mSelCon)
     return NS_ERROR_FAILURE;
 
   LOCK_DOC(this);
 
-  // After ScrollSelectionIntoView(), the pending notifications might be flushed
-  // and PresShell/PresContext/Frames may be dead. See bug 418470.
   result = mSelCon->ScrollSelectionIntoView(nsISelectionController::SELECTION_NORMAL, nsISelectionController::SELECTION_FOCUS_REGION, PR_TRUE);
 
   UNLOCK_DOC(this);
 
   return result;
 }
 
 NS_IMETHODIMP
--- a/embedding/components/find/src/nsWebBrowserFind.cpp
+++ b/embedding/components/find/src/nsWebBrowserFind.cpp
@@ -146,19 +146,16 @@ NS_IMETHODIMP nsWebBrowserFind::FindNext
         windowSupportsData->GetData(getter_AddRefs(searchWindowSupports));
         // findnext performed if search window data cleared out
         *outDidFind = searchWindowSupports == nsnull;
         if (*outDidFind)
             return NS_OK;
     }
 
     // next, look in the current frame. If found, return.
-
-    // Beware! This may flush notifications via synchronous
-    // ScrollSelectionIntoView.
     rv = SearchInFrame(searchFrame, PR_FALSE, outDidFind);
     if (NS_FAILED(rv)) return rv;
     if (*outDidFind)
         return OnFind(searchFrame);     // we are done
 
     // if we are not searching other frames, return
     if (!mSearchSubFrames && !mSearchParentFrames)
         return NS_OK;
@@ -197,18 +194,16 @@ NS_IMETHODIMP nsWebBrowserFind::FindNext
 
         if (doFind)
         {
             searchFrame = do_GetInterface(curItem, &rv);
             if (NS_FAILED(rv)) break;
 
             OnStartSearchFrame(searchFrame);
 
-            // Beware! This may flush notifications via synchronous
-            // ScrollSelectionIntoView.
             rv = SearchInFrame(searchFrame, PR_FALSE, outDidFind);
             if (NS_FAILED(rv)) return rv;
             if (*outDidFind)
                 return OnFind(searchFrame);     // we are done
 
             OnEndSearchFrame(searchFrame);
         }
 
@@ -239,32 +234,28 @@ NS_IMETHODIMP nsWebBrowserFind::FindNext
         nsCOMPtr<nsISupports> curSupports;
         rv = docShellEnumerator->GetNext(getter_AddRefs(curSupports));
         if (NS_FAILED(rv)) break;
         curItem = do_QueryInterface(curSupports, &rv);
         if (NS_FAILED(rv)) break;
 
         if (curItem.get() == startingItem.get())
         {
-            // Beware! This may flush notifications via synchronous
-            // ScrollSelectionIntoView.
             rv = SearchInFrame(searchFrame, PR_TRUE, outDidFind);
             if (NS_FAILED(rv)) return rv;
             if (*outDidFind)
                 return OnFind(searchFrame);        // we are done
             break;
         }
 
         searchFrame = do_GetInterface(curItem, &rv);
         if (NS_FAILED(rv)) break;
 
         OnStartSearchFrame(searchFrame);
 
-        // Beware! This may flush notifications via synchronous
-        // ScrollSelectionIntoView.
         rv = SearchInFrame(searchFrame, PR_FALSE, outDidFind);
         if (NS_FAILED(rv)) return rv;
         if (*outDidFind)
             return OnFind(searchFrame);        // we are done
         
         OnEndSearchFrame(searchFrame);
     }
 
@@ -476,22 +467,19 @@ void nsWebBrowserFind::SetSelectionAndSc
       nsCOMPtr<nsPresContext> presContext = presShell->GetPresContext();
       PRBool isSelectionWithFocus;
       presContext->EventStateManager()->
         MoveFocusToCaret(PR_TRUE, &isSelectionWithFocus);
     }
 
     // Scroll if necessary to make the selection visible:
     // Must be the last thing to do - bug 242056
-
-    // After ScrollSelectionIntoView(), the pending notifications might be
-    // flushed and PresShell/PresContext/Frames may be dead. See bug 418470.
     selCon->ScrollSelectionIntoView
       (nsISelectionController::SELECTION_NORMAL,
-       nsISelectionController::SELECTION_FOCUS_REGION, PR_TRUE);
+       nsISelectionController::SELECTION_FOCUS_REGION, PR_FALSE);
   }
 }
 
 // Adapted from nsTextServicesDocument::GetDocumentContentRootNode
 nsresult nsWebBrowserFind::GetRootNode(nsIDOMDocument* aDomDoc,
                                        nsIDOMNode **aNode)
 {
   nsresult rv;
@@ -828,18 +816,16 @@ nsresult nsWebBrowserFind::SearchInFrame
 
     rv =  mFind->Find(mSearchString.get(), searchRange, startPt, endPt,
                       getter_AddRefs(foundRange));
 
     if (NS_SUCCEEDED(rv) && foundRange)
     {
         *aDidFind = PR_TRUE;
         sel->RemoveAllRanges();
-        // Beware! This may flush notifications via synchronous
-        // ScrollSelectionIntoView.
         SetSelectionAndScroll(aWindow, foundRange);
     }
 
     return rv;
 }
 
 
 // called when we start searching a frame that is not the initial
--- a/extensions/spellcheck/src/mozSpellChecker.cpp
+++ b/extensions/spellcheck/src/mozSpellChecker.cpp
@@ -107,19 +107,16 @@ mozSpellChecker::NextMisspelledWord(nsAS
       do{
         result = mConverter->FindNextWord(str.get(),str.Length(),selOffset,&begin,&end);
         if(NS_SUCCEEDED(result)&&(begin != -1)){
           const nsAString &currWord = Substring(str, begin, end - begin);
           result = CheckWord(currWord, &isMisspelled, aSuggestions);
           if(isMisspelled){
             aWord = currWord;
             mTsDoc->SetSelection(begin, end-begin);
-            // After ScrollSelectionIntoView(), the pending notifications might
-            // be flushed and PresShell/PresContext/Frames may be dead.
-            // See bug 418470.
             mTsDoc->ScrollSelectionIntoView();
             return NS_OK;
           }
         }
         selOffset = end;
       }while(end != -1);
       mTsDoc->NextBlock();
       selOffset=0;
--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@@ -2768,18 +2768,17 @@ PresShell::PageMove(PRBool aForward, PRB
   result = viewManager->GetRootScrollableView(&scrollableView);
   if (NS_FAILED(result)) 
     return result;
   if (!scrollableView) 
     return NS_ERROR_UNEXPECTED;
   nsIView *scrolledView;
   result = scrollableView->GetScrolledView(scrolledView);
   mSelection->CommonPageMove(aForward, aExtend, scrollableView);
-  // After ScrollSelectionIntoView(), the pending notifications might be
-  // flushed and PresShell/PresContext/Frames may be dead. See bug 418470.
+  // do ScrollSelectionIntoView()
   return ScrollSelectionIntoView(nsISelectionController::SELECTION_NORMAL, nsISelectionController::SELECTION_FOCUS_REGION, PR_TRUE);
 }
 
 
 
 NS_IMETHODIMP 
 PresShell::ScrollPage(PRBool aForward)
 {
@@ -2845,18 +2844,16 @@ PresShell::CompleteScroll(PRBool aForwar
     scrollView->ScrollByWhole(!aForward);//TRUE = top, aForward TRUE=bottom
   }
   return NS_OK;
 }
 
 NS_IMETHODIMP
 PresShell::CompleteMove(PRBool aForward, PRBool aExtend)
 {
-  // Beware! This may flush notifications via synchronous
-  // ScrollSelectionIntoView.
   return CompleteMoveInner(aForward, aExtend, PR_TRUE);
 }
 
 nsresult
 PresShell::CompleteMoveInner(PRBool aForward, PRBool aExtend, PRBool aScrollIntoView)
 {
   nsIContent* root = mSelection->GetAncestorLimiter();
   nsIDocument* doc;
@@ -2884,18 +2881,16 @@ PresShell::CompleteMoveInner(PRBool aFor
     }
 
     mSelection->HandleClick(node, offset, offset, aExtend, PR_FALSE, hint);
 
     // HandleClick resets ancestorLimiter, so set it again.
     mSelection->SetAncestorLimiter(root);
 
     if (aScrollIntoView) {
-      // After ScrollSelectionIntoView(), the pending notifications might be
-      // flushed and PresShell/PresContext/Frames may be dead. See bug 418470.
       return
         ScrollSelectionIntoView(nsISelectionController::SELECTION_NORMAL, 
                                 nsISelectionController::SELECTION_FOCUS_REGION,
                                 PR_TRUE);
     }
 
     return NS_OK;
   }
@@ -2930,18 +2925,16 @@ PresShell::CompleteMoveInner(PRBool aFor
   if (!frame)
     return NS_ERROR_FAILURE; //could not find an area frame.
 
   nsPeekOffsetStruct pos = frame->GetExtremeCaretPosition(!aForward);
 
   mSelection->HandleClick(pos.mResultContent ,pos.mContentOffset ,pos.mContentOffset/*End*/ ,aExtend, PR_FALSE, aForward);
 
   if (aScrollIntoView) {
-    // After ScrollSelectionIntoView(), the pending notifications might be
-    // flushed and PresShell/PresContext/Frames may be dead. See bug 418470.
     result = ScrollSelectionIntoView(nsISelectionController::SELECTION_NORMAL, 
                                      nsISelectionController::SELECTION_FOCUS_REGION, PR_TRUE);
     if (NS_FAILED(result)) 
       return result;
   }
   return NS_OK;
 }
 
--- a/layout/forms/nsTextControlFrame.cpp
+++ b/layout/forms/nsTextControlFrame.cpp
@@ -665,18 +665,16 @@ nsTextInputSelectionImpl::GetSelection(P
   NS_ADDREF(*_retval);
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsTextInputSelectionImpl::ScrollSelectionIntoView(PRInt16 aType, PRInt16 aRegion, PRBool aIsSynchronous)
 {
   if (mFrameSelection) {
-    // After ScrollSelectionIntoView(), the pending notifications might be
-    // flushed and PresShell/PresContext/Frames may be dead. See bug 418470.
     nsresult rv = mFrameSelection->ScrollSelectionIntoView(aType, aRegion, aIsSynchronous);
 
     nsIScrollableView* scrollableView = mFrameSelection->GetScrollableView();
     if (!scrollableView) {
       return rv;
     }
     nsIView* view = nsnull;
     scrollableView->GetScrolledView(view);
@@ -856,18 +854,16 @@ nsTextInputSelectionImpl::PageMove(PRBoo
     if (!presShell)
       return NS_ERROR_NULL_POINTER;
 
     //get the scroll view
     nsIScrollableView *scrollableView = mFrameSelection->GetScrollableView();
     if (scrollableView)
       mFrameSelection->CommonPageMove(aForward, aExtend, scrollableView);
   }
-  // After ScrollSelectionIntoView(), the pending notifications might be
-  // flushed and PresShell/PresContext/Frames may be dead. See bug 418470.
   return ScrollSelectionIntoView(nsISelectionController::SELECTION_NORMAL, nsISelectionController::SELECTION_FOCUS_REGION, PR_TRUE);
 }
 
 NS_IMETHODIMP
 nsTextInputSelectionImpl::CompleteScroll(PRBool aForward)
 {
   nsIScrollableView *scrollableView = mFrameSelection->GetScrollableView();
 
--- a/layout/generic/nsSelection.cpp
+++ b/layout/generic/nsSelection.cpp
@@ -2553,20 +2553,18 @@ nsFrameSelection::ScrollSelectionIntoVie
 {
   PRInt8 index = GetIndexFromSelectionType(aType);
   if (index < 0)
     return NS_ERROR_INVALID_ARG;
 
   if (!mDomSelections[index])
     return NS_ERROR_NULL_POINTER;
 
-  // After ScrollSelectionIntoView(), the pending notifications might be
-  // flushed and PresShell/PresContext/Frames may be dead. See bug 418470.
   return mDomSelections[index]->ScrollIntoView(aRegion, aIsSynchronous,
-                                               PR_TRUE);
+                                               PR_FALSE);
 }
 
 nsresult
 nsFrameSelection::RepaintSelection(SelectionType aType) const
 {
   PRInt8 index = GetIndexFromSelectionType(aType);
   if (index < 0)
     return NS_ERROR_INVALID_ARG;
--- a/toolkit/components/typeaheadfind/src/nsTypeAheadFind.cpp
+++ b/toolkit/components/typeaheadfind/src/nsTypeAheadFind.cpp
@@ -570,22 +570,20 @@ nsTypeAheadFind::FindItNow(nsIPresShell 
         }
       }
 
       // Change selection color to ATTENTION and scroll to it.  Careful: we
       // must wait until after we goof with focus above before changing to
       // ATTENTION, or when we MoveFocusToCaret() and the selection is not on a
       // link, we'll blur, which will lose the ATTENTION.
       if (selectionController) {
-        // Beware! This may flush notifications via synchronous
-        // ScrollSelectionIntoView.
         SetSelectionModeAndRepaint(nsISelectionController::SELECTION_ATTENTION);
         selectionController->ScrollSelectionIntoView(
           nsISelectionController::SELECTION_NORMAL, 
-          nsISelectionController::SELECTION_FOCUS_REGION, PR_TRUE);
+          nsISelectionController::SELECTION_FOCUS_REGION, PR_FALSE);
       }
 
       mCurrentWindow = window;
       *aResult = hasWrapped ? FIND_WRAPPED : FIND_FOUND;
       return NS_OK;
     }
 
     // ======= end-inner-while (go through a single document) ==========
@@ -898,18 +896,16 @@ NS_IMETHODIMP
 nsTypeAheadFind::FindAgain(PRBool aFindBackwards, PRBool aLinksOnly,
                            PRUint16* aResult)
 
 {
   *aResult = FIND_NOTFOUND;
 
   mLinksOnly = aLinksOnly;
   if (!mTypeAheadBuffer.IsEmpty())
-    // Beware! This may flush notifications via synchronous
-    // ScrollSelectionIntoView.
     FindItNow(nsnull, mLinksOnly, PR_FALSE, aFindBackwards, aResult);
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsTypeAheadFind::Find(const nsAString& aSearchString, PRBool aLinksOnly,
                       PRUint16* aResult)
@@ -1023,18 +1019,16 @@ nsTypeAheadFind::Find(const nsAString& a
       if (focusedContent) {
         esm->MoveCaretToFocus();
         isFirstVisiblePreferred = PR_FALSE;
       }
     }
   }
 
   // ----------- Find the text! ---------------------
-  // Beware! This may flush notifications via synchronous
-  // ScrollSelectionIntoView.
   nsresult rv = FindItNow(nsnull, mLinksOnly, isFirstVisiblePreferred,
                           PR_FALSE, aResult);
 
   // ---------Handle success or failure ---------------
   if (NS_SUCCEEDED(rv)) {
     if (mTypeAheadBuffer.Length() == 1) {
       // If first letter, store where the first find succeeded
       // (mStartFindRange)