Fix crash when using fastback to go to pages that use SVG in an <object> tag, and bulletproof a little bit. Bug 299153, r+sr=dbaron, a=bsmedberg

docshell/base/nsDocShell.cpp

@@ -5006,20 +5006,22 @@ nsDocShell::FinishRestore()
         }
     }
 
-    nsCOMPtr<nsIDOMDocument> domDoc;
-    mContentViewer->GetDOMDocument(getter_AddRefs(domDoc));
+    if (mContentViewer) {
+        nsCOMPtr<nsIDOMDocument> domDoc;
+        mContentViewer->GetDOMDocument(getter_AddRefs(domDoc));
 
-    nsCOMPtr<nsIDocument> doc = do_QueryInterface(domDoc);
-    if (doc) {
-        // Finally, we remove the request from the loadgroup.  This will cause
-        // onStateChange(STATE_STOP) to fire, which will fire the PageShow
-        // event to the chrome.
+        nsCOMPtr<nsIDocument> doc = do_QueryInterface(domDoc);
+        if (doc) {
+            // Finally, we remove the request from the loadgroup.  This will
+            // cause onStateChange(STATE_STOP) to fire, which will fire the
+            // PageShow event to the chrome.
 
-        nsIChannel *channel = doc->GetChannel();
-        if (channel) {
-            mIsRestoringDocument = PR_TRUE;
-            mLoadGroup->RemoveRequest(channel, nsnull, NS_OK);
-            mIsRestoringDocument = PR_FALSE;
+            nsIChannel *channel = doc->GetChannel();
+            if (channel) {
+                mIsRestoringDocument = PR_TRUE;
+                mLoadGroup->RemoveRequest(channel, nsnull, NS_OK);
+                mIsRestoringDocument = PR_FALSE;
+            }
         }
     }
 

layout/base/nsPresShell.cpp

@@ -6587,8 +6587,21 @@ PresShell::Freeze()
 static void
 StartPluginInstance(PresShell *aShell, nsIContent *aContent)
 {
-  // For now we just reconstruct the frame.
-  aShell->RecreateFramesFor(aContent);
+  // For now we just reconstruct the frame, but only if the element
+  // has a plugin instance.
+  nsIFrame *frame = nsnull;
+  aShell->GetPrimaryFrameFor(aContent, &frame);
+  if (frame) {
+    nsIObjectFrame *objFrame = nsnull;
+    CallQueryInterface(frame, &objFrame);
+    if (objFrame) {
+      nsCOMPtr<nsIPluginInstance> instance;
+      objFrame->GetPluginInstance(*getter_AddRefs(instance));
+      if (instance) {
+        aShell->RecreateFramesFor(aContent);
+      }
+    }
+  }
 }
 
 PR_STATIC_CALLBACK(PRBool)