From 80fe50d37fbfdfe1f2b2d0e0b83d320cc3ecdd75 Mon Sep 17 00:00:00 2001
From: "bryner%brianryner.com"
 <bryner%brianryner.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Wed, 25 Feb 2004 09:10:06 +0000
Subject: [PATCH] Try to fix some crashes from calling PresShell methods after
 Destroy() has called.  Bug 235395, r+sr=roc.

git-svn-id: svn://10.0.0.236/trunk@153206 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/layout/base/nsPresShell.cpp          | 16 ++++++++++------
 mozilla/layout/html/base/src/nsPresShell.cpp | 16 ++++++++++------
 2 files changed, 20 insertions(+), 12 deletions(-)

diff --git a/mozilla/layout/base/nsPresShell.cpp b/mozilla/layout/base/nsPresShell.cpp
index 746c9c4f690..8caf5a4bc69 100644
--- a/mozilla/layout/base/nsPresShell.cpp
+++ b/mozilla/layout/base/nsPresShell.cpp
@@ -1342,6 +1342,7 @@ protected:
   PRPackedBool mDidInitialReflow;
   PRPackedBool mIgnoreFrameDestruction;
   PRPackedBool mStylesHaveChanged;
+  PRPackedBool mHaveShutDown;
 
   nsIFrame*   mCurrentEventFrame;
   nsIContent* mCurrentEventContent;
@@ -1623,7 +1624,7 @@ PresShell::QueryInterface(const nsIID& aIID, void** aInstancePtr)
 
 PresShell::~PresShell()
 {
-  if (mStyleSet) {
+  if (!mHaveShutDown) {
     NS_NOTREACHED("Someone did not call nsIPresShell::destroy");
     Destroy();
   }
@@ -1637,7 +1638,9 @@ PresShell::~PresShell()
                mFirstCallbackEventRequest == nsnull &&
                mLastCallbackEventRequest == nsnull,
                "post-reflow queues not empty.  This means we're leaking");
-
+ 
+  delete mFrameManager;
+  delete mStyleSet;
   delete mFrameConstructor;
 
   NS_IF_RELEASE(mCurrentEventContent);
@@ -1814,6 +1817,9 @@ PresShell::Destroy()
   }
 #endif
 
+  if (mHaveShutDown)
+    return NS_OK;
+
   // If our paint suppression timer is still active, kill it.
   if (mPaintSuppressionTimer) {
     mPaintSuppressionTimer->Cancel();
@@ -1871,14 +1877,10 @@ PresShell::Destroy()
   // Destroy the frame manager. This will destroy the frame hierarchy
   if (mFrameManager) {
     mFrameManager->Destroy();
-    delete mFrameManager;
-    mFrameManager = nsnull;
   }
 
   // Let the style set do its cleanup.
   mStyleSet->Shutdown(mPresContext);
-  delete mStyleSet;
-  mStyleSet = nsnull;
 
   // We hold a reference to the pres context, and it holds a weak link back
   // to us. To avoid the pres context having a dangling reference, set its 
@@ -1902,6 +1904,8 @@ PresShell::Destroy()
   CancelAllReflowCommands();
   KillResizeEventTimer();
 
+  mHaveShutDown = PR_TRUE;
+
   return NS_OK;
 }
 
diff --git a/mozilla/layout/html/base/src/nsPresShell.cpp b/mozilla/layout/html/base/src/nsPresShell.cpp
index 746c9c4f690..8caf5a4bc69 100644
--- a/mozilla/layout/html/base/src/nsPresShell.cpp
+++ b/mozilla/layout/html/base/src/nsPresShell.cpp
@@ -1342,6 +1342,7 @@ protected:
   PRPackedBool mDidInitialReflow;
   PRPackedBool mIgnoreFrameDestruction;
   PRPackedBool mStylesHaveChanged;
+  PRPackedBool mHaveShutDown;
 
   nsIFrame*   mCurrentEventFrame;
   nsIContent* mCurrentEventContent;
@@ -1623,7 +1624,7 @@ PresShell::QueryInterface(const nsIID& aIID, void** aInstancePtr)
 
 PresShell::~PresShell()
 {
-  if (mStyleSet) {
+  if (!mHaveShutDown) {
     NS_NOTREACHED("Someone did not call nsIPresShell::destroy");
     Destroy();
   }
@@ -1637,7 +1638,9 @@ PresShell::~PresShell()
                mFirstCallbackEventRequest == nsnull &&
                mLastCallbackEventRequest == nsnull,
                "post-reflow queues not empty.  This means we're leaking");
-
+ 
+  delete mFrameManager;
+  delete mStyleSet;
   delete mFrameConstructor;
 
   NS_IF_RELEASE(mCurrentEventContent);
@@ -1814,6 +1817,9 @@ PresShell::Destroy()
   }
 #endif
 
+  if (mHaveShutDown)
+    return NS_OK;
+
   // If our paint suppression timer is still active, kill it.
   if (mPaintSuppressionTimer) {
     mPaintSuppressionTimer->Cancel();
@@ -1871,14 +1877,10 @@ PresShell::Destroy()
   // Destroy the frame manager. This will destroy the frame hierarchy
   if (mFrameManager) {
     mFrameManager->Destroy();
-    delete mFrameManager;
-    mFrameManager = nsnull;
   }
 
   // Let the style set do its cleanup.
   mStyleSet->Shutdown(mPresContext);
-  delete mStyleSet;
-  mStyleSet = nsnull;
 
   // We hold a reference to the pres context, and it holds a weak link back
   // to us. To avoid the pres context having a dangling reference, set its 
@@ -1902,6 +1904,8 @@ PresShell::Destroy()
   CancelAllReflowCommands();
   KillResizeEventTimer();
 
+  mHaveShutDown = PR_TRUE;
+
   return NS_OK;
 }