Fix for a problem where the dummyLayoutRequest was being removed during incremental layout and thus causing some terrible crashes. See the bug for the gory details. b=90733 sr=waterson r=nisheeth

layout/base/nsPresShell.cpp

@@ -1073,6 +1073,8 @@ protected:
   // This method should be called after a reflow commands have been
   // removed from the queue, but after the state in the presshell is
   // such that it's safe to flush (i.e. mIsReflowing == PR_FALSE)
+  // If we are not reflowing and ther are no load-crated reflow commands, then
+  // the dummyLayoutRequest is removed
   void DoneRemovingReflowCommands();
 
   nsresult AddDummyLayoutRequest(void);
@@ -6121,7 +6123,7 @@ PresShell::ReflowCommandRemoved(nsIReflowCommand* aRC)
 void
 PresShell::DoneRemovingReflowCommands()
 {
-  if (mRCCreatedDuringLoad == 0 && mDummyLayoutRequest) {
+  if (mRCCreatedDuringLoad == 0 && mDummyLayoutRequest && !mIsReflowing) {
     RemoveDummyLayoutRequest();
   }
 }

layout/html/base/src/nsPresShell.cpp

@@ -1073,6 +1073,8 @@ protected:
   // This method should be called after a reflow commands have been
   // removed from the queue, but after the state in the presshell is
   // such that it's safe to flush (i.e. mIsReflowing == PR_FALSE)
+  // If we are not reflowing and ther are no load-crated reflow commands, then
+  // the dummyLayoutRequest is removed
   void DoneRemovingReflowCommands();
 
   nsresult AddDummyLayoutRequest(void);
@@ -6121,7 +6123,7 @@ PresShell::ReflowCommandRemoved(nsIReflowCommand* aRC)
 void
 PresShell::DoneRemovingReflowCommands()
 {
-  if (mRCCreatedDuringLoad == 0 && mDummyLayoutRequest) {
+  if (mRCCreatedDuringLoad == 0 && mDummyLayoutRequest && !mIsReflowing) {
     RemoveDummyLayoutRequest();
   }
 }