Bug 391178 - Avoid walking frame tree when destroying nsTreeColFrame. r+sr=roc, a=blocking1.9+

layout/xul/base/src/tree/src/nsTreeColFrame.cpp

@@ -45,6 +45,7 @@
 #include "nsIDOMNSDocument.h"
 #include "nsIDocument.h"
 #include "nsIBoxObject.h"
+#include "nsTreeBoxObject.h"
 #include "nsIDOMElement.h"
 #include "nsITreeBoxObject.h"
 #include "nsITreeColumns.h"
@@ -99,7 +100,7 @@ nsTreeColFrame::Init(nsIContent*      aContent,
 void                                                                
 nsTreeColFrame::Destroy()                          
 {
-  InvalidateColumns();
+  InvalidateColumns(PR_FALSE);
   nsBoxFrame::Destroy();
 }
 
@@ -220,12 +221,21 @@ nsTreeColFrame::GetTreeBoxObject()
 }
 
 void
-nsTreeColFrame::InvalidateColumns()
+nsTreeColFrame::InvalidateColumns(PRBool aCanWalkFrameTree)
 {
   nsITreeBoxObject* treeBoxObject = GetTreeBoxObject();
   if (treeBoxObject) {
     nsCOMPtr<nsITreeColumns> columns;
-    treeBoxObject->GetColumns(getter_AddRefs(columns));
+
+    if (aCanWalkFrameTree) {
+      treeBoxObject->GetColumns(getter_AddRefs(columns));
+    } else {
+      nsITreeBoxObject* body =
+        static_cast<nsTreeBoxObject*>(treeBoxObject)->GetCachedTreeBody();
+      if (body) {
+        body->GetColumns(getter_AddRefs(columns));
+      }
+    }
 
     if (columns)
       columns->InvalidateColumns();

layout/xul/base/src/tree/src/nsTreeColFrame.h

@@ -89,5 +89,5 @@ protected:
    * Helper method that gets the nsITreeColumns object this column belongs to
    * and calls InvalidateColumns() on it.
    */
-  void InvalidateColumns();
+  void InvalidateColumns(PRBool aCanWalkFrameTree = PR_TRUE);
 };