Check childrens' type before derefencing pointers to them. b=487393 r=josh sr=roc

widget/src/cocoa/nsChildView.h

@@ -409,6 +409,8 @@ public:
 
   void              HidePlugin();
 
+  void              ResetParent();
+
 protected:
 
   PRBool            ReportDestroyEvent();

widget/src/cocoa/nsChildView.mm

@@ -540,7 +540,7 @@ nsChildView::~nsChildView()
   // notify the children that we're gone
   for (nsIWidget* kid = mFirstChild; kid; kid = kid->GetNextSibling()) {
     nsChildView* childView = static_cast<nsChildView*>(kid);
-    childView->mParentWidget = nsnull;
+    childView->ResetParent();
   }
 
   NS_WARN_IF_FALSE(mOnDestroyCalled, "nsChildView object destroyed without calling Destroy()");
@@ -996,7 +996,7 @@ NS_IMETHODIMP nsChildView::Show(PRBool aState)
   NS_OBJC_END_TRY_ABORT_BLOCK_NSRESULT;
 }
 
-// Reset the parent of this widget
+// Change the parent of this widget
 NS_IMETHODIMP
 nsChildView::SetParent(nsIWidget* aNewParent)
 {
@@ -1029,6 +1029,17 @@ nsChildView::SetParent(nsIWidget* aNewParent)
   NS_OBJC_END_TRY_ABORT_BLOCK_NSRESULT;
 }
 
+void nsChildView::ResetParent()
+{
+  if (!mOnDestroyCalled) {
+    if (mParentWidget)
+      mParentWidget->RemoveChild(this);
+    if (mView)
+      [mView removeFromSuperview];
+  }
+  mParentWidget = nsnull;
+}
+
 nsIWidget*
 nsChildView::GetParent(void)
 {

widget/src/cocoa/nsCocoaWindow.mm

@@ -146,10 +146,19 @@ nsCocoaWindow::~nsCocoaWindow()
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK;
 
-  // notify the children that we're gone
+  // Notify the children that we're gone.  Popup windows (e.g. tooltips) can
+  // have nsChildView children.  'kid' is an nsChildView object if and only if
+  // its 'type' is 'eWindowType_child'.
   for (nsIWidget* kid = mFirstChild; kid; kid = kid->GetNextSibling()) {
-    nsCocoaWindow* childWindow = static_cast<nsCocoaWindow*>(kid);
-    childWindow->mParent = nsnull;
+    nsWindowType kidType;
+    kid->GetWindowType(kidType);
+    if (kidType == eWindowType_child) {
+      nsChildView* childView = static_cast<nsChildView*>(kid);
+      childView->ResetParent();
+    } else {
+      nsCocoaWindow* childWindow = static_cast<nsCocoaWindow*>(kid);
+      childWindow->mParent = nsnull;
+    }
   }
 
   if (mWindow) {