Bug 898871 - Hold a strong ref on the pres shell while scrolling, check for damage afterwards. r=roc a=abillings
authorMats Palmgren <matspal@gmail.com>
Fri, 09 Aug 2013 23:48:29 +0000
changeset 153685 1a4a74fa7cf11f91a64447fd0b8d83c6a40f6f02
parent 153684 7c52efc15dfd4705bb34ea7f23f5de4985c7f2e2
child 153686 c0d97b086e9ff5086f39dafd5c449d2be51772c7
push id2859
push userakeybl@mozilla.com
push dateMon, 16 Sep 2013 19:14:59 +0000
treeherdermozilla-beta@87d3c51cd2bf [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersroc, abillings
bugs898871
milestone25.0a2
Bug 898871 - Hold a strong ref on the pres shell while scrolling, check for damage afterwards. r=roc a=abillings
content/html/document/src/ImageDocument.cpp
--- a/content/html/document/src/ImageDocument.cpp
+++ b/content/html/document/src/ImageDocument.cpp
@@ -339,16 +339,21 @@ ImageDocument::ShrinkToFit()
   nsCOMPtr<nsIDOMHTMLImageElement> image = do_QueryInterface(mImageContent);
   image->SetWidth(std::max(1, NSToCoordFloor(GetRatio() * mImageWidth)));
   image->SetHeight(std::max(1, NSToCoordFloor(GetRatio() * mImageHeight)));
   
   // The view might have been scrolled when zooming in, scroll back to the
   // origin now that we're showing a shrunk-to-window version.
   ScrollImageTo(0, 0, false);
 
+  if (!mImageContent) {
+    // ScrollImageTo flush destroyed our content.
+    return;
+  }
+
   SetModeClass(eShrinkToFit);
   
   mImageIsResized = true;
   
   UpdateTitleAndCharset();
 }
 
 NS_IMETHODIMP
@@ -370,17 +375,17 @@ ImageDocument::ScrollImageTo(int32_t aX,
 {
   float ratio = GetRatio();
 
   if (restoreImage) {
     RestoreImage();
     FlushPendingNotifications(Flush_Layout);
   }
 
-  nsIPresShell *shell = GetShell();
+  nsCOMPtr<nsIPresShell> shell = GetShell();
   if (!shell)
     return;
 
   nsIScrollableFrame* sf = shell->GetRootScrollFrameAsScrollable();
   if (!sf)
     return;
 
   nsRect portRect = sf->GetScrollPortRect();