From ba496b391ddaf1a854e80062aebefebe130c6eb5 Mon Sep 17 00:00:00 2001
From: "attinasi%netscape.com"
 <attinasi%netscape.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Fri, 7 Dec 2001 00:02:03 +0000
Subject: [PATCH] Prevent crash when IFRAME is reframed during layout.
 bug=108105 r=dbaron sr=jst

git-svn-id: svn://10.0.0.236/trunk@109903 18797224-902f-48f8-a5cc-f745e15eee43
---
 .../html/document/src/nsHTMLContentSink.cpp        | 14 +++++++++++++-
 mozilla/docshell/base/nsDocShell.cpp               |  9 +++++++++
 mozilla/docshell/base/nsIDocShell.idl              |  5 +++++
 3 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/mozilla/content/html/document/src/nsHTMLContentSink.cpp b/mozilla/content/html/document/src/nsHTMLContentSink.cpp
index ba30a39a245..d06e2bc40a9 100644
--- a/mozilla/content/html/document/src/nsHTMLContentSink.cpp
+++ b/mozilla/content/html/document/src/nsHTMLContentSink.cpp
@@ -2797,7 +2797,19 @@ HTMLContentSink::DidBuildModel(PRInt32 aQualityLevel)
     SINK_TRACE(SINK_TRACE_REFLOW,
                ("HTMLContentSink::DidBuildModel: forcing reflow on empty document"));
 
-    StartLayout();
+    // NOTE: only force the layout if we are NOT destroying the webshell. If we are destroying it, then 
+    //       starting layout will likely cause us to crash, or at best waste a lot of time as we are just
+    //       going to tear it down anyway.
+    PRBool bDestroying = PR_TRUE;
+    if (mWebShell) {
+      nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(mWebShell));
+      if (docShell) {
+        docShell->IsBeingDestroyed(&bDestroying);
+      }
+    }
+    if (!bDestroying) {
+      StartLayout();
+    }
   }
 
   ScrollToRef();
diff --git a/mozilla/docshell/base/nsDocShell.cpp b/mozilla/docshell/base/nsDocShell.cpp
index 8e8a31c0fb6..94698e4c09f 100644
--- a/mozilla/docshell/base/nsDocShell.cpp
+++ b/mozilla/docshell/base/nsDocShell.cpp
@@ -5862,6 +5862,15 @@ nsDocShell::GetCanvasHasFocus(PRBool *aCanvasHasFocus)
   return NS_ERROR_FAILURE;
 }
 
+/* boolean IsBeingDestroyed (); */
+NS_IMETHODIMP 
+nsDocShell::IsBeingDestroyed(PRBool *aDoomed)
+{
+  NS_ENSURE_ARG(aDoomed);
+  *aDoomed = mIsBeingDestroyed;
+  return NS_OK;
+}
+
 //*****************************************************************************
 //***    nsRefreshTimer: Object Management
 //*****************************************************************************
diff --git a/mozilla/docshell/base/nsIDocShell.idl b/mozilla/docshell/base/nsIDocShell.idl
index 7b7e365ad6e..cb8f993a62f 100644
--- a/mozilla/docshell/base/nsIDocShell.idl
+++ b/mozilla/docshell/base/nsIDocShell.idl
@@ -276,5 +276,10 @@ interface nsIDocShell : nsISupports
    * attribute to access the loadtype  for the document
    */
   attribute unsigned long  loadType;
+
+  /*
+   * returns true if the docshell is being destroyed, false otherwise
+   */
+  boolean IsBeingDestroyed();
 };