From b48fe04ebd8fe0bf1e7b56565f48633bb9cf330a Mon Sep 17 00:00:00 2001
From: Mats Palmgren <matspal@gmail.com>
Date: Tue, 15 Jan 2013 21:47:10 +0100
Subject: [PATCH] Bug 830236 - Add re-entrancy protection in a few places to
 avoid destroying things twice.  r=cam

---
 layout/base/nsDocumentViewer.cpp  | 7 ++++---
 layout/printing/nsPrintEngine.cpp | 8 +++++++-
 layout/printing/nsPrintEngine.h   | 1 +
 layout/printing/nsPrintObject.cpp | 5 +++--
 4 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/layout/base/nsDocumentViewer.cpp b/layout/base/nsDocumentViewer.cpp
index eeea9038a6c1..26230d1c1ec7 100644
--- a/layout/base/nsDocumentViewer.cpp
+++ b/layout/base/nsDocumentViewer.cpp
@@ -4262,11 +4262,12 @@ nsDocumentViewer::OnDonePrinting()
 {
 #if defined(NS_PRINTING) && defined(NS_PRINT_PREVIEW)
   if (mPrintEngine) {
+    nsRefPtr<nsPrintEngine> pe = mPrintEngine;
+    mPrintEngine = nullptr;
     if (GetIsPrintPreview()) {
-      mPrintEngine->DestroyPrintingData();
+      pe->DestroyPrintingData();
     } else {
-      mPrintEngine->Destroy();
-      mPrintEngine = nullptr;
+      pe->Destroy();
     }
 
     // We are done printing, now cleanup 
diff --git a/layout/printing/nsPrintEngine.cpp b/layout/printing/nsPrintEngine.cpp
index 26c38b28a670..834df28cc959 100644
--- a/layout/printing/nsPrintEngine.cpp
+++ b/layout/printing/nsPrintEngine.cpp
@@ -239,7 +239,8 @@ nsPrintEngine::nsPrintEngine() :
   mOldPrtPreview(nullptr),
   mDebugFile(nullptr),
   mLoadCounter(0),
-  mDidLoadDataForPrinting(false)
+  mDidLoadDataForPrinting(false),
+  mIsDestroying(false)
 {
 }
 
@@ -252,6 +253,11 @@ nsPrintEngine::~nsPrintEngine()
 //-------------------------------------------------------
 void nsPrintEngine::Destroy()
 {
+  if (mIsDestroying) {
+    return;
+  }
+  mIsDestroying = true;
+
   if (mPrt) {
     delete mPrt;
     mPrt = nullptr;
diff --git a/layout/printing/nsPrintEngine.h b/layout/printing/nsPrintEngine.h
index 8a92c7a246b3..ab2b39c09f55 100644
--- a/layout/printing/nsPrintEngine.h
+++ b/layout/printing/nsPrintEngine.h
@@ -280,6 +280,7 @@ protected:
 
   int32_t mLoadCounter;
   bool mDidLoadDataForPrinting;
+  bool mIsDestroying;
 
   nsresult AfterNetworkPrint(bool aHandleError);
 
diff --git a/layout/printing/nsPrintObject.cpp b/layout/printing/nsPrintObject.cpp
index e21c83bef862..a8114d9b8da0 100644
--- a/layout/printing/nsPrintObject.cpp
+++ b/layout/printing/nsPrintObject.cpp
@@ -113,10 +113,11 @@ nsPrintObject::DestroyPresentation()
 #endif
     mPresShell->EndObservingDocument();
     nsAutoScriptBlocker scriptBlocker;
-    mPresShell->Destroy();
+    nsCOMPtr<nsIPresShell> shell = mPresShell;
+    mPresShell = nullptr;
+    shell->Destroy();
   }
   mPresContext = nullptr;
-  mPresShell   = nullptr;
   mViewManager = nullptr;
 }