From b8cf83ad8248305093b2895f0e2dd7ed0c80aeee Mon Sep 17 00:00:00 2001
From: "bzbarsky%mit.edu" <bzbarsky%mit.edu>
Date: Fri, 16 Sep 2005 15:38:04 +0000
Subject: [PATCH] Make sure not to access members of deleted SheetLoadDatas. 
 Bug 308766, r+sr=jst

---
 layout/style/nsCSSLoader.cpp | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/layout/style/nsCSSLoader.cpp b/layout/style/nsCSSLoader.cpp
index 7d9e6a640b97..f7089564258b 100644
--- a/layout/style/nsCSSLoader.cpp
+++ b/layout/style/nsCSSLoader.cpp
@@ -1831,12 +1831,16 @@ CSSLoaderImpl::LoadChildSheet(nsICSSStyleSheet* aParentSheet,
   }
 
   NS_ADDREF(data);
+  PRBool syncLoad = data->mSyncLoad;
 
   // Load completion will release the data
   rv = LoadSheet(data, state);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  data->mMustNotify = PR_TRUE;
+  // If syncLoad is true, |data| will be deleted by now.
+  if (!syncLoad) {
+    data->mMustNotify = PR_TRUE;
+  }
   return rv;  
 }