From b80a1908dbba6101b1f6727a6e8a5a8bf56d10e8 Mon Sep 17 00:00:00 2001
From: "Olli.Pettay%helsinki.fi"
 <Olli.Pettay%helsinki.fi@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Wed, 24 May 2006 20:31:59 +0000
Subject: [PATCH] Bug 336978, Crash when window gets destroyed on pagehide
 event, r+sr=bryner

git-svn-id: svn://10.0.0.236/trunk@198348 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/docshell/base/nsDocShell.cpp     | 3 +++
 mozilla/layout/base/nsDocumentViewer.cpp | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/mozilla/docshell/base/nsDocShell.cpp b/mozilla/docshell/base/nsDocShell.cpp
index 2690725e507..5fb3d692f8f 100644
--- a/mozilla/docshell/base/nsDocShell.cpp
+++ b/mozilla/docshell/base/nsDocShell.cpp
@@ -921,6 +921,9 @@ NS_IMETHODIMP
 nsDocShell::FirePageHideNotification(PRBool aIsUnload)
 {
     if (mContentViewer && !mFiredUnloadEvent) {
+        // Keep an explicit reference since calling PageHide could release
+        // mContentViewer
+        nsCOMPtr<nsIContentViewer> kungFuDeathGrip(mContentViewer);
         mFiredUnloadEvent = PR_TRUE;
 
         mContentViewer->PageHide(aIsUnload);
diff --git a/mozilla/layout/base/nsDocumentViewer.cpp b/mozilla/layout/base/nsDocumentViewer.cpp
index b03a24a8d55..9300b28dac1 100644
--- a/mozilla/layout/base/nsDocumentViewer.cpp
+++ b/mozilla/layout/base/nsDocumentViewer.cpp
@@ -1240,6 +1240,9 @@ DocumentViewerImpl::PageHide(PRBool aIsUnload)
   if (!aIsUnload)
     return NS_OK;
 
+  // if Destroy() was called during OnPageHide(), mDocument is nsnull.
+  NS_ENSURE_STATE(mDocument);
+
   // First, get the window from the document...
   nsPIDOMWindow *window = mDocument->GetWindow();