From d58c94b6609aac70a1e40687171918e2a01f38aa Mon Sep 17 00:00:00 2001
From: "bzbarsky%mit.edu"
 <bzbarsky%mit.edu@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Mon, 27 Nov 2006 22:29:40 +0000
Subject: [PATCH] Revoke pending reflow events before tearing down the frame
 tree. Bug 347662, r+sr=dbaron, a=dveditz

git-svn-id: svn://10.0.0.236/branches/MOZILLA_1_8_0_BRANCH@215910 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/layout/base/nsPresShell.cpp | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/mozilla/layout/base/nsPresShell.cpp b/mozilla/layout/base/nsPresShell.cpp
index cc6a51abc7e..8b6c187e0ec 100644
--- a/mozilla/layout/base/nsPresShell.cpp
+++ b/mozilla/layout/base/nsPresShell.cpp
@@ -1975,6 +1975,18 @@ PresShell::Destroy()
     mDocument->DeleteShell(this);
   }
 
+  // Revoke pending events.  We need to do this and cancel reflow commands
+  // before we destroy the frame manager, since apparently frame destruction
+  // sometimes spins the event queue when plug-ins are involved(!).
+  mPostedReplaces = nsnull;
+  mReflowEventQueue = nsnull;
+  nsCOMPtr<nsIEventQueue> eventQueue;
+  mEventQueueService->GetSpecialEventQueue(nsIEventQueueService::UI_THREAD_EVENT_QUEUE,
+                                           getter_AddRefs(eventQueue));
+  eventQueue->RevokeEvents(this);
+
+  CancelAllReflowCommands();
+
   // Destroy the frame manager. This will destroy the frame hierarchy
   mFrameConstructor->WillDestroyFrameTree();
   FrameManager()->Destroy();
@@ -2009,16 +2021,6 @@ PresShell::Destroy()
     NS_RELEASE(mViewEventListener);
   }
 
-  // Revoke pending events
-  mPostedReplaces = nsnull;
-  mReflowEventQueue = nsnull;
-  nsCOMPtr<nsIEventQueue> eventQueue;
-  mEventQueueService->GetSpecialEventQueue(nsIEventQueueService::UI_THREAD_EVENT_QUEUE,
-                                           getter_AddRefs(eventQueue));
-  eventQueue->RevokeEvents(this);
-
-  CancelAllReflowCommands();
-
   RemoveDummyLayoutRequest();
   
   KillResizeEventTimer();