From eecbba2fa3da6206ec656221a079dff92c2e4065 Mon Sep 17 00:00:00 2001
From: "roc+%cs.cmu.edu" <roc+%cs.cmu.edu@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Sat, 26 Jan 2008 22:45:42 +0000
Subject: [PATCH] Bug 410860. Get the prescontext before 'frame' is set to
 null. r+sr=mats, a=schrep

git-svn-id: svn://10.0.0.236/trunk@244065 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/content/base/crashtests/410860-1.xml    | 8 ++++++++
 mozilla/content/base/crashtests/crashtests.list | 1 +
 mozilla/content/base/src/nsGenericElement.cpp   | 5 +++--
 3 files changed, 12 insertions(+), 2 deletions(-)
 create mode 100644 mozilla/content/base/crashtests/410860-1.xml

diff --git a/mozilla/content/base/crashtests/410860-1.xml b/mozilla/content/base/crashtests/410860-1.xml
new file mode 100644
index 00000000000..4a7414fc9b6
--- /dev/null
+++ b/mozilla/content/base/crashtests/410860-1.xml
@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg" 
+     xmlns:xlink="http://www.w3.org/1999/xlink" 
+     onload="document.getElementById('x').getBoundingClientRect();">
+
+<rect id="x"/>
+
+</svg>
+
diff --git a/mozilla/content/base/crashtests/crashtests.list b/mozilla/content/base/crashtests/crashtests.list
index 6b4b463e9d4..9d77abc4196 100644
--- a/mozilla/content/base/crashtests/crashtests.list
+++ b/mozilla/content/base/crashtests/crashtests.list
@@ -21,3 +21,4 @@ load 386000-1.html
 load 386794-1.html
 load 399712-1.html
 load 407818.html
+load 410860-1.xml
diff --git a/mozilla/content/base/src/nsGenericElement.cpp b/mozilla/content/base/src/nsGenericElement.cpp
index 9822268cbac..8b5e2ae8d50 100644
--- a/mozilla/content/base/src/nsGenericElement.cpp
+++ b/mozilla/content/base/src/nsGenericElement.cpp
@@ -782,11 +782,12 @@ nsNSElementTearoff::GetBoundingClientRect(nsIDOMTextRectangle** aResult)
 
   NS_ADDREF(*aResult = rect);
   
-  nsIFrame* frame = mContent->GetPrimaryFrame(Flush_Layout);  
+  nsIFrame* frame = mContent->GetPrimaryFrame(Flush_Layout);
   if (!frame) {
     // display:none, perhaps? Return the empty rect
     return NS_OK;
   }
+  nsPresContext* presContext = frame->PresContext();
   
   nsRect r;
   if (TryGetSVGBoundingRect(frame, &r)) {
@@ -805,7 +806,7 @@ nsNSElementTearoff::GetBoundingClientRect(nsIDOMTextRectangle** aResult)
     r = nsLayoutUtils::GetAllInFlowBoundingRect(frame) +
         GetOffsetFromInitialContainingBlock(frame);
   }
-  SetTextRectangle(r, frame->PresContext(), rect);
+  SetTextRectangle(r, presContext, rect);
   return NS_OK;
 }