Bug 231830, crash on style.display = 'none' for select element when event onchange occurs [@ nsStyleContext::GetRuleNode ][@ nsIFrame::Invalidate ], r+sr=bz

layout/forms/nsComboboxControlFrame.cpp

@@ -375,6 +375,7 @@ NS_IMETHODIMP nsComboboxControlFrame::GetAccessible(nsIAccessible** aAccessible)
 void 
 nsComboboxControlFrame::SetFocus(PRBool aOn, PRBool aRepaint)
 {
+  nsWeakFrame weakFrame(this);
   if (aOn) {
     nsListControlFrame::ComboboxFocusSet();
     mFocused = this;
@@ -383,9 +384,14 @@ nsComboboxControlFrame::SetFocus(PRBool aOn, PRBool aRepaint)
     if (mDroppedDown) {
       mListControlFrame->ComboboxFinish(mDisplayedIndex);
     }
+    // May delete |this|.
     mListControlFrame->FireOnChange();
   }
 
+  if (!weakFrame.IsAlive()) {
+    return;
+  }
+
   // This is needed on a temporary basis. It causes the focus
   // rect to be drawn. This is much faster than ReResolvingStyle
   // Bug 32920

layout/forms/nsListControlFrame.cpp

@@ -1933,7 +1933,7 @@ nsListControlFrame::ToggleOptionSelectedFromFrame(PRInt32 aIndex)
 
 
 // Dispatch event and such
-void
+PRBool
 nsListControlFrame::UpdateSelection()
 {
   if (mIsAllFramesHere) {
@@ -1943,9 +1943,12 @@ nsListControlFrame::UpdateSelection()
     }
     // if it's a listbox, fire on change
     else if (mIsAllContentHere) {
+      nsWeakFrame weakFrame(this);
       FireOnChange();
+      return weakFrame.IsAlive();
     }
   }
+  return PR_TRUE;
 }
 
 void
@@ -3054,7 +3057,10 @@ nsListControlFrame::KeyPress(nsIDOMEvent* aKeyEvent)
                                  nsCaseInsensitiveStringComparator())) {
               PRBool wasChanged = PerformSelection(index, isShift, isControl);
               if (wasChanged) {
-                UpdateSelection(); // dispatch event, update combobox, etc.
+                // dispatch event, update combobox, etc.
+                if (!UpdateSelection()) {
+                  return NS_OK;
+                }
               }
               break;
             }
@@ -3088,7 +3094,10 @@ nsListControlFrame::KeyPress(nsIDOMEvent* aKeyEvent)
       wasChanged = PerformSelection(newIndex, isShift, isControl);
     }
     if (wasChanged) {
-      UpdateSelection(); // dispatch event, update combobox, etc.
+       // dispatch event, update combobox, etc.
+      if (!UpdateSelection()) {
+        return NS_OK;
+      }
     }
 #ifdef ACCESSIBILITY
     if (charcode != ' ') {

layout/forms/nsListControlFrame.h

@@ -153,7 +153,6 @@ public:
   virtual void SyncViewWithFrame();
   virtual void AboutToDropDown();
   virtual void AboutToRollup();
-  virtual void UpdateSelection();
   virtual void SetOverrideReflowOptimization(PRBool aValue) { mOverrideReflowOpt = aValue; }
   virtual void FireOnChange();
   virtual void ComboboxFinish(PRInt32 aIndex);
@@ -201,6 +200,8 @@ public:
 #endif
 
 protected:
+  // Returns PR_FALSE if calling it destroyed |this|.
+  PRBool     UpdateSelection();
   PRBool     GetMultiple(nsIDOMHTMLSelectElement* aSelect = nsnull) const;
   void       DropDownToggleKey(nsIDOMEvent* aKeyEvent);
   nsresult   IsOptionDisabled(PRInt32 anIndex, PRBool &aIsDisabled);