From e855fa7e8eee955217322bb0b67d40d3f2fbbdd2 Mon Sep 17 00:00:00 2001
From: "mats.palmgren%bredband.net"
 <mats.palmgren%bredband.net@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Fri, 18 Jan 2008 18:18:19 +0000
Subject: [PATCH] Ignore restyle requests once PresShell::Destroy() has been
 called. b=279505 r+sr=bzbarsky a=mtschrep

git-svn-id: svn://10.0.0.236/trunk@243460 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/layout/base/nsCSSFrameConstructor.cpp | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/mozilla/layout/base/nsCSSFrameConstructor.cpp b/mozilla/layout/base/nsCSSFrameConstructor.cpp
index 77eef8001e9..862762e7953 100644
--- a/mozilla/layout/base/nsCSSFrameConstructor.cpp
+++ b/mozilla/layout/base/nsCSSFrameConstructor.cpp
@@ -13273,6 +13273,11 @@ nsCSSFrameConstructor::PostRestyleEvent(nsIContent* aContent,
                                         nsReStyleHint aRestyleHint,
                                         nsChangeHint aMinChangeHint)
 {
+  if (NS_UNLIKELY(mIsDestroyingFrameTree)) {
+    NS_NOTREACHED("PostRestyleEvent after the shell is destroyed (bug 279505)");
+    return;
+  }
+
   if (aRestyleHint == 0 && !aMinChangeHint) {
     // Nothing to do here
     return;