Bug 1432396 - Check the docshell is being destroyed along with the tree owner at the top of nsDocShell::CreateContentViewer(). r=bz

We bail out the function to make sure we don't process CreateContentViewer
and mLoadingURI is not re-initialized in the function while destroying the
docshell.

MozReview-Commit-ID: AYJ1t2N786N

--HG--
extra : rebase_source : b02c6a061a8938936b40195e166ac2b6c187406d

docshell/base/nsDocShell.cpp

@@ -8698,7 +8698,7 @@ nsDocShell::CreateContentViewer(const nsACString& aContentType,
 {
   *aContentHandler = nullptr;
 
-  if (!mTreeOwner) {
+  if (!mTreeOwner || mIsBeingDestroyed) {
     // If we don't have a tree owner, then we're in the process of being
     // destroyed. Rather than continue trying to load something, just give up.
     return NS_ERROR_DOCSHELL_DYING;