Bug 664672 - When a tab has been removed, cut off its link to the browser. r=gavin

browser/base/content/tabbrowser.xml

@@ -1682,6 +1682,10 @@
             // a consistent state (tab removed, tab positions updated, etc.).
             panel.removeChild(browser.parentNode);
 
+            // Release the browser in case something is erroneously holding a
+            // reference to the tab after its removal.
+            aTab.linkedBrowser = null;
+
             // As the browser is removed, the removal of a dependent document can
             // cause the whole window to close. So at this point, it's possible
             // that the binding is destructed.

browser/base/content/test/Makefile.in

@@ -172,6 +172,7 @@ _BROWSER_FILES = \
                  browser_bug624734.js \
                  browser_bug647886.js \
                  browser_bug655584.js \
+                 browser_bug664672.js \
                  browser_findbarClose.js \
                  browser_keywordBookmarklets.js \
                  browser_contextSearchTabPosition.js \

browser/base/content/test/browser_bug664672.js

@@ -0,0 +1,19 @@
+function test() {
+  waitForExplicitFinish();
+
+  var tab = gBrowser.addTab();
+
+  tab.addEventListener("TabClose", function () {
+    tab.removeEventListener("TabClose", arguments.callee, false);
+
+    ok(tab.linkedBrowser, "linkedBrowser should still exist during the TabClose event");
+
+    executeSoon(function () {
+      ok(!tab.linkedBrowser, "linkedBrowser should be gone after the TabClose event");
+
+      finish();
+    });
+  }, false);
+
+  gBrowser.removeTab(tab);
+}