Bug 1309982. Check if presshell is destroying before proceeding to do more work in PresShell::ReconstructFrames. r=mats a=ritu
authorTimothy Nikkel <tnikkel@gmail.com>
Thu, 20 Oct 2016 16:42:16 -0500
changeset 350768 def5ec38d5749c1ab9729d1e47f9c8804ea51c95
parent 350767 f1cca2fddc00d20bfc1693f02d37d40b7103bc18
child 350769 0b0bf76318dc9c5eaf2b8f86bb4132a1d01f7d93
push id1230
push userjlund@mozilla.com
push dateMon, 31 Oct 2016 18:13:35 +0000
treeherdermozilla-release@5e06e3766db2 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersmats, ritu
bugs1309982
milestone50.0
Bug 1309982. Check if presshell is destroying before proceeding to do more work in PresShell::ReconstructFrames. r=mats a=ritu PresShell::Destroy calls destroy on the frame constructor/manager, which clears it's local presshell pointer, thus causing us to crash.
layout/base/nsPresShell.cpp
--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@@ -4452,27 +4452,31 @@ PresShell::NotifyCounterStylesAreDirty()
   mFrameConstructor->EndUpdate();
 }
 
 nsresult
 PresShell::ReconstructFrames(void)
 {
   NS_PRECONDITION(!mFrameConstructor->GetRootFrame() || mDidInitialize,
                   "Must not have root frame before initial reflow");
-  if (!mDidInitialize) {
+  if (!mDidInitialize || mIsDestroying) {
     // Nothing to do here
     return NS_OK;
   }
 
   nsCOMPtr<nsIPresShell> kungFuDeathGrip(this);
 
   // Have to make sure that the content notifications are flushed before we
   // start messing with the frame model; otherwise we can get content doubling.
   mDocument->FlushPendingNotifications(Flush_ContentAndNotify);
 
+  if (mIsDestroying) {
+    return NS_OK;
+  }
+
   nsAutoCauseReflowNotifier crNotifier(this);
   mFrameConstructor->BeginUpdate();
   nsresult rv = mFrameConstructor->ReconstructDocElementHierarchy();
   VERIFY_STYLE_TREE;
   mFrameConstructor->EndUpdate();
 
   return rv;
 }