diff --git a/mozilla/content/base/src/nsDocument.cpp b/mozilla/content/base/src/nsDocument.cpp index ca75aef3938..662c81fafe4 100644 --- a/mozilla/content/base/src/nsDocument.cpp +++ b/mozilla/content/base/src/nsDocument.cpp @@ -4928,17 +4928,15 @@ nsDocument::Destroy() mIsGoingAway = PR_TRUE; DestroyLinkMap(); for (PRInt32 indx = 0; indx < count; ++indx) { - nsIContent* content = mChildren.ChildAt(indx); - if (content == mRootContent) { - // Null out mRootContent first; this is similar to what RemoveChildAt() - // does. - mRootContent = nsnull; - } - - // XXXbz what about document observer notifications? We really need to get - // rid of this Destroy() method! - - content->UnbindFromTree(); + // XXXbz what we _should_ do here is to clear mChildren and null out + // mRootContent. If we did this (or at least the latter), we could remove + // the silly null-checks in nsHTMLDocument::MatchLinks. Unfortunately, + // doing that introduces several problems: + // 1) Focus issues (see bug 341730). The fix for bug 303260 may fix these. + // 2) Crashes in OnPageHide if it fires after Destroy. See bug 303260 + // comments 9 and 10. + // So we're just creating an inconsistent DOM for now and hoping. :( + mChildren.ChildAt(indx)->UnbindFromTree(); } // Propagate the out-of-band notification to each PresShell's anonymous diff --git a/mozilla/content/html/document/src/nsHTMLDocument.cpp b/mozilla/content/html/document/src/nsHTMLDocument.cpp index 70e66386486..d6625d09490 100644 --- a/mozilla/content/html/document/src/nsHTMLDocument.cpp +++ b/mozilla/content/html/document/src/nsHTMLDocument.cpp @@ -1732,8 +1732,9 @@ nsHTMLDocument::MatchLinks(nsIContent *aContent, PRInt32 aNamespaceID, nsIAtom* aAtom, const nsAString& aData) { nsINodeInfo *ni = aContent->GetNodeInfo(); + nsIDocument *doc = aContent->GetDocument(); - if (ni) { + if (ni && doc) { NS_ASSERTION(aContent->IsInDoc(), "This method should never be called on content nodes that " "are not in a document!");