Flush _before_ getting the presshell, not after. Bug 297079, r+sr=roc, a=asa

git-svn-id: svn://10.0.0.236/branches/MOZILLA_1_8_BRANCH@178855 18797224-902f-48f8-a5cc-f745e15eee43

mozilla/layout/xul/base/src/nsBoxObject.cpp

@@ -184,13 +184,14 @@ nsBoxObject::GetOffsetRect(nsRect& aRect)
   nsCOMPtr<nsIDocument> doc = mContent->GetDocument();
 
   if (doc) {
+    // Flush all pending notifications so that our frames are uptodate.  Must
+    // do this before we get the presshell, since this can destroy presshells.
+    doc->FlushPendingNotifications(Flush_Layout);
+
     // Get Presentation shell 0
     nsIPresShell *presShell = doc->GetShellAt(0);
 
     if(presShell) {
-      // Flush all pending notifications so that our frames are uptodate
-      doc->FlushPendingNotifications(Flush_Layout);
-
       // Get the Frame for our content
       nsIFrame* frame = nsnull;
       presShell->GetPrimaryFrameFor(mContent, &frame);