bug 363791, stop caching nsTreeColumns pointer in nsTreeColFrame to fix a crash accessing a stale pointer.

r=neil@parkwaycc, sr=roc, a=jay


git-svn-id: svn://10.0.0.236/branches/MOZILLA_1_8_0_BRANCH@218598 18797224-902f-48f8-a5cc-f745e15eee43

mozilla/content/xul/content/src/nsXULElement.cpp

@@ -2533,8 +2533,8 @@ nsXULElement::GetBoxObject(nsIBoxObject** aResult)
 
   // XXX sXBL/XBL2 issue! Owner or current document?
   nsCOMPtr<nsIDOMNSDocument> nsDoc(do_QueryInterface(GetCurrentDoc()));
-  NS_ENSURE_TRUE(nsDoc, NS_ERROR_FAILURE);
-  return nsDoc->GetBoxObjectFor(this, aResult);
+
+  return nsDoc ? nsDoc->GetBoxObjectFor(this, aResult) : NS_ERROR_FAILURE;
 }
 
 // Methods for setting/getting attributes from nsIDOMXULElement

mozilla/layout/xul/base/src/tree/src/nsTreeColFrame.cpp

@@ -46,6 +46,7 @@
 #include "nsIDOMNSDocument.h"
 #include "nsIDocument.h"
 #include "nsIBoxObject.h"
+#include "nsITreeColumns.h"
 #include "nsIDOMElement.h"
 #include "nsITreeBoxObject.h"
 #include "nsIDOMXULTreeElement.h"
@@ -110,17 +111,14 @@ nsTreeColFrame::Init(nsPresContext*  aPresContext,
                      nsIFrame*        aPrevInFlow)
 {
   nsresult rv = nsBoxFrame::Init(aPresContext, aContent, aParent, aContext, aPrevInFlow);
-  EnsureColumns();
-  if (mColumns)
-    mColumns->InvalidateColumns();
+  InvalidateColumns();
   return rv;
 }
 
 NS_IMETHODIMP                                                                   
 nsTreeColFrame::Destroy(nsPresContext* aPresContext)                          
 {
-  if (mColumns)
-    mColumns->InvalidateColumns();
+  InvalidateColumns(); 
   return nsBoxFrame::Destroy(aPresContext);
 }
 
@@ -189,9 +187,7 @@ nsTreeColFrame::AttributeChanged(nsIContent* aChild,
                                              aAttribute, aModType);
 
   if (aAttribute == nsXULAtoms::ordinal || aAttribute == nsXULAtoms::primary) {
-    EnsureColumns();
-    if (mColumns)
-      mColumns->InvalidateColumns();
+    InvalidateColumns();
   }
 
   return rv;
@@ -206,30 +202,43 @@ nsTreeColFrame::SetBounds(nsBoxLayoutState& aBoxLayoutState,
   nsresult rv = nsBoxFrame::SetBounds(aBoxLayoutState, aRect,
                                       aRemoveOverflowArea);
   if (mRect.width != oldWidth) {
-    EnsureColumns();
-    if (mColumns) {
-      nsCOMPtr<nsITreeBoxObject> tree;
-      mColumns->GetTree(getter_AddRefs(tree));
-      if (tree)
-        tree->Invalidate();
+    nsITreeBoxObject* treeBoxObject = GetTreeBoxObject();
+    if (treeBoxObject) {
+      treeBoxObject->Invalidate();
     }
   }
   return rv;
 }
 
-void
-nsTreeColFrame::EnsureColumns()
+nsITreeBoxObject*
+nsTreeColFrame::GetTreeBoxObject()
 {
-  if (!mColumns) {
-    // Get our parent node.
-    nsIContent* parent = mContent->GetParent();
-    if (parent) {
-      nsIContent* grandParent = parent->GetParent();
-      if (grandParent) {
-        nsCOMPtr<nsIDOMXULTreeElement> treeElement = do_QueryInterface(grandParent);
-        if (treeElement)
-          treeElement->GetColumns(getter_AddRefs(mColumns));
-      }
+  nsITreeBoxObject* result = nsnull;
+
+  nsIContent* parent = mContent->GetParent();
+  if (parent) {
+    nsIContent* grandParent = parent->GetParent();
+    nsCOMPtr<nsIDOMXULElement> treeElement = do_QueryInterface(grandParent);
+    if (treeElement) {
+      nsCOMPtr<nsIBoxObject> boxObject;
+      treeElement->GetBoxObject(getter_AddRefs(boxObject));
+
+      nsCOMPtr<nsITreeBoxObject> treeBoxObject = do_QueryInterface(boxObject);
+      result = treeBoxObject.get();
     }
   }
+  return result;
+}
+
+void
+nsTreeColFrame::InvalidateColumns()
+{
+  nsITreeBoxObject* treeBoxObject = GetTreeBoxObject();
+  if (treeBoxObject) {
+    nsCOMPtr<nsITreeColumns> columns;
+    treeBoxObject->GetColumns(getter_AddRefs(columns));
+
+    if (columns)
+      columns->InvalidateColumns();
+  }
 }

mozilla/layout/xul/base/src/tree/src/nsTreeColFrame.h

@@ -37,7 +37,8 @@
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsBoxFrame.h"
-#include "nsITreeColumns.h"
+
+class nsITreeBoxObject;
 
 nsresult NS_NewTreeColFrame(nsIPresShell* aPresShell, 
                             nsIFrame** aNewFrame, 
@@ -79,7 +80,14 @@ protected:
   nsTreeColFrame(nsIPresShell* aPresShell, PRBool aIsRoot = nsnull, nsIBoxLayout* aLayoutManager = nsnull);
   virtual ~nsTreeColFrame();
 
-  void EnsureColumns();
-  
-  nsCOMPtr<nsITreeColumns>      mColumns;
+  /**
+   * @return the tree box object of the tree this column belongs to, or nsnull.
+   */
+  nsITreeBoxObject* GetTreeBoxObject();
+
+  /**
+   * Helper method that gets the nsITreeColumns object this column belongs to
+   * and calls InvalidateColumns() on it.
+   */
+  void InvalidateColumns();
 };