Don't crash if the file input's frame is destroyed while the filepicker is up.

Bug 230998, r+sr=dbaron


git-svn-id: svn://10.0.0.236/trunk@151481 18797224-902f-48f8-a5cc-f745e15eee43

mozilla/layout/forms/nsFileControlFrame.cpp

@@ -131,6 +131,7 @@ nsFileControlFrame::Destroy(nsIPresContext* aPresContext)
     nsCOMPtr<nsITextControlElement> fileInput = do_QueryInterface(mContent);
     fileInput->TakeTextFrameValue(value);
   }
+  mTextFrame = nsnull;
   return nsAreaFrame::Destroy(aPresContext);
 }
 
@@ -324,6 +325,11 @@ nsFileControlFrame::MouseClick(nsIDOMEvent* aMouseEvent)
   if (mode == nsIFilePicker::returnCancel)
     return NS_OK;
 
+  if (!mTextFrame) {
+    // We got destroyed while the filepicker was up.  Don't do anything here.
+    return NS_OK;
+  }
+  
   // Set property
   nsCOMPtr<nsILocalFile> localFile;
   result = filePicker->GetFile(getter_AddRefs(localFile));