bug 73262, r=pinkerton, sr=sfraser/jst, set weak ref to xul document after adding nsMenuBar as observer, then use that weak ref in destructor to remove ourself as observer, problem is that webshell is getting destroyed before nsMenuBar, so nsMenuBar can't get at the xul document, thus it can't remove itself as an observer.

widget/src/mac/nsMenuBar.cpp

@@ -112,6 +112,7 @@ nsMenuBar::nsMenuBar()
 
   mOriginalMacMBarHandle = nsnull;
   mMacMBarHandle = nsnull;
+  mDocument = nsnull;
   
   mOriginalMacMBarHandle = ::GetMenuBar();
   Handle tmp = ::GetMenuBar();
@@ -144,12 +145,9 @@ nsMenuBar::~nsMenuBar()
   NS_ASSERTION(err==noErr,"nsMenu::~nsMenu: DisposeUnicodeToTextRunInfo failed.");	 
 
   // make sure we unregister ourselves as a document observer
-  nsCOMPtr<nsIWebShell> webShell ( do_QueryReferent(mWebShellWeakRef) );
-  nsCOMPtr<nsIDocument> doc;
-  GetDocument(webShell, getter_AddRefs(doc));
-  if ( doc ) {
+  if ( mDocument ) {
     nsCOMPtr<nsIDocumentObserver> observer ( do_QueryInterface(NS_STATIC_CAST(nsIMenuBar*,this)) );
-    doc->RemoveObserver(observer);
+    mDocument->RemoveObserver(observer);
   }
 
   --gMenuBarCounter;
@@ -283,6 +281,9 @@ nsMenuBar :: RegisterAsDocumentObserver ( nsIWebShell* inWebShell )
   // register ourselves
   nsCOMPtr<nsIDocumentObserver> observer ( do_QueryInterface(NS_STATIC_CAST(nsIMenuBar*,this)) );
   doc->AddObserver(observer);
+  // also get pointer to doc, just in case webshell goes away
+  // we can still remove ourself as doc observer directly from doc
+  mDocument = doc;
 
 } // RegisterAsDocumentObesrver
 
@@ -775,6 +776,7 @@ nsMenuBar::StyleRuleRemoved(nsIDocument * aDocument, nsIStyleSheet * aStyleSheet
 NS_IMETHODIMP
 nsMenuBar::DocumentWillBeDestroyed( nsIDocument * aDocument )
 {
+  mDocument = nsnull; // just for yucks
   return NS_OK;
 }
 

widget/src/mac/nsMenuBarX.cpp

@@ -72,6 +72,7 @@ nsMenuBarX::nsMenuBarX()
     mNumMenus       = 0;
     mParent         = nsnull;
     mIsMenuBarAdded = PR_FALSE;
+    mDocument       = nsnull;
 
     OSStatus status = ::CreateNewMenu(0, 0, &mRootMenu);
     NS_ASSERTION(status == noErr, "nsMenuBarX::nsMenuBarX:  creation of root menu failed.");
@@ -90,12 +91,9 @@ nsMenuBarX::~nsMenuBarX()
     mMenusArray.Clear();    // release all menus
 
     // make sure we unregister ourselves as a document observer
-    nsCOMPtr<nsIWebShell> webShell ( do_QueryReferent(mWebShellWeakRef) );
-    nsCOMPtr<nsIDocument> doc;
-    GetDocument(webShell, getter_AddRefs(doc));
-    if ( doc ) {
+    if ( mDocument ) {
         nsCOMPtr<nsIDocumentObserver> observer ( do_QueryInterface(NS_STATIC_CAST(nsIMenuBar*,this)) );
-        doc->RemoveObserver(observer);
+        mDocument->RemoveObserver(observer);
     }
 
     if (mRootMenu != NULL) {
@@ -227,6 +225,9 @@ nsMenuBarX :: RegisterAsDocumentObserver ( nsIWebShell* inWebShell )
     // register ourselves
     nsCOMPtr<nsIDocumentObserver> observer ( do_QueryInterface(NS_STATIC_CAST(nsIMenuBar*,this)) );
     doc->AddObserver(observer);
+    // also get pointer to doc, just in case webshell goes away
+    // we can still remove ourself as doc observer directly from doc
+    mDocument = doc;
 } // RegisterAsDocumentObesrver
 
 
@@ -584,6 +585,7 @@ nsMenuBarX::StyleRuleRemoved(nsIDocument * aDocument, nsIStyleSheet * aStyleShee
 NS_IMETHODIMP
 nsMenuBarX::DocumentWillBeDestroyed( nsIDocument * aDocument )
 {
+  mDocument = nsnull;
   return NS_OK;
 }