Bug 338312 - destruction of an object with paint server set could crash.

r+sr=roc

layout/svg/base/src/nsSVGGeometryFrame.cpp

@@ -56,12 +56,16 @@ nsSVGGeometryFrame::nsSVGGeometryFrame(nsStyleContext* aContext)
 {
 }
 
-nsSVGGeometryFrame::~nsSVGGeometryFrame()
+void
+nsSVGGeometryFrame::Destroy()
 {
+  // Do this here instead of in the destructor, so virtual calls still work
   if (mFillServer)
     mFillServer->RemoveObserver(this);
   if (mStrokeServer)
     mStrokeServer->RemoveObserver(this);
+
+  nsSVGGeometryFrameBase::Destroy();
 }
 
 nsSVGPaintServerFrame *

layout/svg/base/src/nsSVGGeometryFrame.h

@@ -59,9 +59,9 @@ class nsSVGGeometryFrame : public nsSVGGeometryFrameBase,
 {
 public:
   nsSVGGeometryFrame(nsStyleContext *aContext);
-  ~nsSVGGeometryFrame();
 
   // nsIFrame interface:
+  virtual void Destroy();
   NS_IMETHOD DidSetStyleContext();
 
   // nsISupports interface: