Bug 805745. WillPaint notification can flush, so re-get the listener after it on Windows widget backend. r=jimm

widget/windows/nsWindow.h

@@ -451,6 +451,7 @@ protected:
                                            PAINTSTRUCT ps, HDC aDC);
   static void             ActivateOtherWindowHelper(HWND aWnd);
   void                    ClearCachedResources();
+  nsIWidgetListener*      GetPaintListener();
 
 protected:
   nsCOMPtr<nsIWidget>   mParent;

widget/windows/nsWindowGfx.cpp

@@ -163,6 +163,13 @@ EnsureSharedSurfaceSize(gfxIntSize size)
   return (sSharedSurfaceData != nullptr);
 }
 
+nsIWidgetListener* nsWindow::GetPaintListener()
+{
+  if (mDestroyCalled)
+    return nullptr;
+  return mAttachedWidgetListener ? mAttachedWidgetListener : mWidgetListener;
+}
+
 bool nsWindow::OnPaint(HDC aDC, uint32_t aNestingLevel)
 {
   // We never have reentrant paint events, except when we're running our RPC
@@ -205,10 +212,14 @@ bool nsWindow::OnPaint(HDC aDC, uint32_t aNestingLevel)
     return true;
   }
 
-  nsIWidgetListener* listener = mAttachedWidgetListener ? mAttachedWidgetListener : mWidgetListener;
+  nsIWidgetListener* listener = GetPaintListener();
   if (listener) {
     listener->WillPaintWindow(this, true);
   }
+  // Re-get the listener since the will paint notification may have killed it.
+  listener = GetPaintListener();
+  if (!listener)
+    return false;
 
   bool result = true;
   PAINTSTRUCT ps;