Bug 877097: Hold strong refs to instances of ScrollbarActivity to avoid crashing. r=mats

layout/generic/ScrollbarActivity.h

@@ -88,7 +88,9 @@ public:
   virtual void WillRefresh(TimeStamp aTime) MOZ_OVERRIDE;
 
   static void FadeBeginTimerFired(nsITimer* aTimer, void* aSelf) {
-    reinterpret_cast<ScrollbarActivity*>(aSelf)->BeginFade();
+    nsRefPtr<ScrollbarActivity> scrollbarActivity(
+      reinterpret_cast<ScrollbarActivity*>(aSelf));
+    scrollbarActivity->BeginFade();
   }
 
 protected:

layout/generic/nsGfxScrollFrame.cpp

@@ -3014,7 +3014,8 @@ void nsGfxScrollFrameInner::CurPosAttributeChanged(nsIContent* aContent)
   }
 
   if (mScrollbarActivity) {
-    mScrollbarActivity->ActivityOccurred();
+    nsRefPtr<ScrollbarActivity> scrollbarActivity(mScrollbarActivity);
+    scrollbarActivity->ActivityOccurred();
   }
 
   bool isSmooth = aContent->HasAttr(kNameSpaceID_None, nsGkAtoms::smooth);
@@ -3889,7 +3890,8 @@ nsGfxScrollFrameInner::SetCoordAttribute(nsIContent* aContent, nsIAtom* aAtom,
   aContent->SetAttr(kNameSpaceID_None, aAtom, newValue, true);
 
   if (mScrollbarActivity) {
-    mScrollbarActivity->ActivityOccurred();
+    nsRefPtr<ScrollbarActivity> scrollbarActivity(mScrollbarActivity);
+    scrollbarActivity->ActivityOccurred();
   }
 }
 

layout/generic/nsGfxScrollFrame.h

@@ -287,7 +287,7 @@ public:
   nsIFrame* mResizerBox;
   nsContainerFrame* mOuter;
   nsRefPtr<AsyncScroll> mAsyncScroll;
-  nsCOMPtr<ScrollbarActivity> mScrollbarActivity;
+  nsRefPtr<ScrollbarActivity> mScrollbarActivity;
   nsTArray<nsIScrollPositionListener*> mListeners;
   nsRect mScrollPort;
   // Where we're currently scrolling to, if we're scrolling asynchronously.

layout/xul/tree/nsTreeBodyFrame.h

@@ -543,7 +543,7 @@ protected: // Data Members
 
   nsRevocableEventPtr<ScrollEvent> mScrollEvent;
 
-  nsCOMPtr<ScrollbarActivity> mScrollbarActivity;
+  nsRefPtr<ScrollbarActivity> mScrollbarActivity;
 
   // The cached box object parent.
   nsCOMPtr<nsITreeBoxObject> mTreeBoxObject;