From 4a4a0bcf45995fdc29caefba2766932dfc25be7d Mon Sep 17 00:00:00 2001
From: Kartikaya Gupta <kgupta@mozilla.com>
Date: Mon, 21 Dec 2015 14:40:20 -0500
Subject: [PATCH] Bug 1234242 - Keep a RefPtr to the refresh driver to
 unregister the ScrollEvent, rather than relying on a chain of pointers
 remaining non-null. r=mstange a=KWierso

--HG--
extra : commitid : JouJUWdzJl6
---
 layout/generic/nsGfxScrollFrame.cpp | 6 ++++--
 layout/generic/nsGfxScrollFrame.h   | 1 +
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/layout/generic/nsGfxScrollFrame.cpp b/layout/generic/nsGfxScrollFrame.cpp
index fe73db6afb3d..ec3363785b1f 100644
--- a/layout/generic/nsGfxScrollFrame.cpp
+++ b/layout/generic/nsGfxScrollFrame.cpp
@@ -4228,12 +4228,14 @@ void ScrollFrameHelper::CurPosAttributeChanged(nsIContent* aContent)
 ScrollFrameHelper::ScrollEvent::ScrollEvent(ScrollFrameHelper* aHelper)
   : mHelper(aHelper)
 {
-  mHelper->mOuter->PresContext()->RefreshDriver()->AddRefreshObserver(this, Flush_Style);
+  mDriver = mHelper->mOuter->PresContext()->RefreshDriver();
+  mDriver->AddRefreshObserver(this, Flush_Style);
 }
 
 ScrollFrameHelper::ScrollEvent::~ScrollEvent()
 {
-  mHelper->mOuter->PresContext()->RefreshDriver()->RemoveRefreshObserver(this, Flush_Style);
+  mDriver->RemoveRefreshObserver(this, Flush_Style);
+  mDriver = nullptr;
 }
 
 void
diff --git a/layout/generic/nsGfxScrollFrame.h b/layout/generic/nsGfxScrollFrame.h
index 5ee4f1195fa6..2075921b8a97 100644
--- a/layout/generic/nsGfxScrollFrame.h
+++ b/layout/generic/nsGfxScrollFrame.h
@@ -111,6 +111,7 @@ public:
     virtual ~ScrollEvent();
   private:
     ScrollFrameHelper *mHelper;
+    RefPtr<nsRefreshDriver> mDriver;
   };
 
   class AsyncScrollPortEvent : public nsRunnable {