fix for #20508

set parent of anonymous  to nsnull before destroying the frames, and remove the frame references from the event state mananger
r=hyatt,waterson
a=chofmann


git-svn-id: svn://10.0.0.236/trunk@56051 18797224-902f-48f8-a5cc-f745e15eee43

mozilla/layout/xul/base/src/nsTreeRowGroupFrame.cpp

@@ -1018,6 +1018,13 @@ nsTreeRowGroupFrame::ReflowAfterRowLayout(nsIPresContext*       aPresContext,
     }
    
     if (nukeScrollbar || (value == "0" && !mIsFull)) {
+      
+      // clear the scrollbar out of the event state manager so that the
+      // event manager doesn't send events to the destroyed scrollbar frames
+      nsCOMPtr<nsIPresShell> shell;
+      aPresContext->GetShell(getter_AddRefs(shell));
+      ClearFrameRefs(shell, mScrollbar);
+      
       // Nuke the scrollbar.
       mFrameConstructor->RemoveMappingsForFrameSubtree(aPresContext, mScrollbar, nsnull);
       mScrollbarList.DestroyFrames(aPresContext);
@@ -1961,6 +1968,30 @@ nsTreeRowGroupFrame :: AttributeChanged ( nsIPresContext* aPresContext, nsIConte
 } // AttributeChanged
 
 
+void
+nsTreeRowGroupFrame::ClearFrameRefs(nsIPresShell *aShell, nsIFrame *aParent)
+{
+  nsIFrame* child;
+  aParent->FirstChild(nsnull,&child);
+
+  while (child) {
+
+    // since we're destroying anonymous frames, we should also
+    // set the parent to null. Otherwise, the event manager holds a
+    // reference to the anonymous node, but the parent <scrollbar> node
+    // goes away
+    // we don't do this to aParent because that's the scrollbar node itself
+    nsCOMPtr<nsIContent> content;
+    child->GetContent(getter_AddRefs(content));
+    content->SetParent(nsnull);
+    
+    ClearFrameRefs(aShell, child);
+    child->GetNextSibling(&child);
+  }
+  aShell->ClearFrameRefs(aParent);
+}
+
+
 
 //
 // Paint

mozilla/layout/xul/base/src/nsTreeRowGroupFrame.h

@@ -150,6 +150,8 @@ protected:
 
   void ComputeTotalRowCount(PRInt32& rowCount, nsIContent* aParent);
 
+  static void ClearFrameRefs(nsIPresShell* aPresShell, nsIFrame *aParent);
+  
 public:
   // Helpers that allow access to info. The tree is the primary consumer of this
   // info.