Fix crashes when dynamically removing input type=file elements by not calling GetValue() during Destroy() since that re-adds the frame to the primary frame map. Bug 203041, 238906, patch originally by mats.palmgren@bredband.net, updated by me, r+sr=bzbarsky.

git-svn-id: svn://10.0.0.236/trunk@156745 18797224-902f-48f8-a5cc-f745e15eee43

mozilla/layout/forms/nsFileControlFrame.cpp

@@ -97,7 +97,8 @@ NS_NewFileControlFrame(nsIPresShell* aPresShell, nsIFrame** aNewFrame)
 
 nsFileControlFrame::nsFileControlFrame():
   mTextFrame(nsnull), 
-  mCachedState(nsnull)
+  mCachedState(nsnull),
+  mDidPreDestroy(PR_FALSE)
 {
     //Shrink the area around it's contents
   SetFlags(NS_BLOCK_SHRINK_WRAP);
@@ -117,8 +118,8 @@ nsFileControlFrame::~nsFileControlFrame()
   }
 }
 
-NS_IMETHODIMP 
-nsFileControlFrame::Destroy(nsIPresContext* aPresContext)
+void
+nsFileControlFrame::PreDestroy(nsIPresContext* aPresContext)
 {
   // Toss the value into the control from the anonymous content, which is about
   // to get lost.
@@ -131,10 +132,32 @@ nsFileControlFrame::Destroy(nsIPresContext* aPresContext)
     nsCOMPtr<nsITextControlElement> fileInput = do_QueryInterface(mContent);
     fileInput->TakeTextFrameValue(value);
   }
+  mDidPreDestroy = PR_TRUE;
+}
+
+NS_IMETHODIMP
+nsFileControlFrame::Destroy(nsIPresContext* aPresContext)
+{
+  if (!mDidPreDestroy) {
+    PreDestroy(aPresContext);
+  }
   mTextFrame = nsnull;
   return nsAreaFrame::Destroy(aPresContext);
 }
 
+void
+nsFileControlFrame::RemovedAsPrimaryFrame(nsIPresContext* aPresContext)
+{
+  if (!mDidPreDestroy) {
+    PreDestroy(aPresContext);
+  }
+#ifdef DEBUG
+  else {
+    NS_ERROR("RemovedAsPrimaryFrame called after PreDestroy");
+  }
+#endif
+}
+
 NS_IMETHODIMP
 nsFileControlFrame::CreateAnonymousContent(nsIPresContext* aPresContext,
                                            nsISupportsArray& aChildList)