Bug 778355 - Don't clear mWindow in nsWebShellWindow's destructor; nsXULWindow will clear it when it's destroyed. r=roc

Also, in nsWindowMediator's shutdown observer, release all of our nsXULWindow references after we release mListLock.  Without this, nsXULWindow's destructor can call back into nsWindowMediator, try to acquire mListLock, and deadlock.

xpfe/appshell/src/nsWebShellWindow.cpp

@@ -92,12 +92,6 @@ nsWebShellWindow::nsWebShellWindow(PRUint32 aChromeFlags)
 
 nsWebShellWindow::~nsWebShellWindow()
 {
-  if (mWindow) {
-    mWindow->SetClientData(0);
-    mWindow->Destroy();
-    mWindow = nullptr; // Force release here.
-  }
-
   MutexAutoLock lock(mSPTimerLock);
   if (mSPTimer)
     mSPTimer->Cancel();

xpfe/appshell/src/nsWindowMediator.cpp

@@ -757,9 +757,19 @@ nsWindowMediator::Observe(nsISupports* aSubject,
                           const PRUnichar* aData)
 {
   if (!strcmp(aTopic, "xpcom-shutdown") && mReady) {
-    MutexAutoLock lock(mListLock);
-    while (mOldestWindow)
-      UnregisterWindow(mOldestWindow);
+    // Unregistering a window may cause its destructor to run, causing it to
+    // call into the window mediator, try to acquire mListLock, and deadlock.
+    // Our solution is to hold strong refs to all windows until we release
+    // mListLock.
+    nsTArray<nsCOMPtr<nsIXULWindow> > windows;
+
+    {
+      MutexAutoLock lock(mListLock);
+      while (mOldestWindow) {
+        windows.AppendElement(mOldestWindow->mWindow);
+        UnregisterWindow(mOldestWindow);
+      }
+    }
     mReady = false;
   }
   return NS_OK;