Bug 1234242 - Keep a RefPtr to the refresh driver to unregister the ScrollEvent, rather than relying on a chain of pointers remaining non-null. r=mstange a=KWierso

--HG--
extra : commitid : JouJUWdzJl6

layout/generic/nsGfxScrollFrame.cpp

@@ -4228,12 +4228,14 @@ void ScrollFrameHelper::CurPosAttributeChanged(nsIContent* aContent)
 ScrollFrameHelper::ScrollEvent::ScrollEvent(ScrollFrameHelper* aHelper)
   : mHelper(aHelper)
 {
-  mHelper->mOuter->PresContext()->RefreshDriver()->AddRefreshObserver(this, Flush_Style);
+  mDriver = mHelper->mOuter->PresContext()->RefreshDriver();
+  mDriver->AddRefreshObserver(this, Flush_Style);
 }
 
 ScrollFrameHelper::ScrollEvent::~ScrollEvent()
 {
-  mHelper->mOuter->PresContext()->RefreshDriver()->RemoveRefreshObserver(this, Flush_Style);
+  mDriver->RemoveRefreshObserver(this, Flush_Style);
+  mDriver = nullptr;
 }
 
 void

layout/generic/nsGfxScrollFrame.h

@@ -111,6 +111,7 @@ public:
     virtual ~ScrollEvent();
   private:
     ScrollFrameHelper *mHelper;
+    RefPtr<nsRefreshDriver> mDriver;
   };
 
   class AsyncScrollPortEvent : public nsRunnable {