Bug 749738 - Use weak references to avoid accessing dead objects in findbar [r=mak]

browser/base/content/test/Makefile.in

@@ -182,6 +182,7 @@ _BROWSER_FILES = \
                  browser_bug710878.js \
                  browser_bug719271.js \
                  browser_bug743421.js \
+                 browser_bug749738.js \
                  browser_canonizeURL.js \
                  browser_findbarClose.js \
                  browser_homeDrop.js \

browser/base/content/test/browser_bug749738.js

@@ -0,0 +1,36 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict";
+
+const DUMMY_PAGE = "http://example.org/browser/browser/base/content/test/dummy_page.html";
+
+function test() {
+  waitForExplicitFinish();
+
+  let tab = gBrowser.addTab();
+  gBrowser.selectedTab = tab;
+
+  load(tab, DUMMY_PAGE, function() {
+    gFindBar.onFindCommand();
+    EventUtils.sendString("Dummy");
+    gBrowser.removeTab(tab);
+
+    try {
+      gFindBar.close();
+      ok(true, "findbar.close should not throw an exception");
+    } catch(e) {
+      ok(false, "findbar.close threw exception: " + e);
+    }
+    finish();
+  });
+}
+
+function load(aTab, aUrl, aCallback) {
+  aTab.linkedBrowser.addEventListener("load", function onload(aEvent) {
+    aEvent.currentTarget.removeEventListener("load", onload, true);
+    waitForFocus(aCallback, content);
+  }, true);
+  aTab.linkedBrowser.loadURI(aUrl);
+}

toolkit/content/widgets/findbar.xml

@@ -284,13 +284,22 @@
       <field name="_tmpOutline">null</field>
       <field name="_tmpOutlineOffset">"0"</field>
       <field name="_drawOutline">false</field>
-      <field name="_foundLink">null</field>
       <field name="_editors">null</field>
       <field name="_stateListeners">null</field>
 
       <field name="_flashFindBar">0</field>
       <field name="_initialFlashFindBarCount">6</field>
 
+      <property name="_foundLink"
+                onget="return this._foundLinkRef.get();"
+                onset="this._foundLinkRef = Components.utils.getWeakReference(val); return val;"/>
+      <property name="_foundEditable"
+                onget="return this._foundEditableRef.get();"
+                onset="this._foundEditableRef = Components.utils.getWeakReference(val); return val;"/>
+      <property name="_currentWindow"
+                onget="return this._currentWindowRef.get();"
+                onset="this._currentWindowRef = Components.utils.getWeakReference(val); return val;"/>
+
       <property name="prefillWithSelection"
                 onget="return this.getAttribute('prefillwithselection') != 'false'"
                 onset="this.setAttribute('prefillwithselection', val); return val;"/>
@@ -381,6 +390,10 @@
         this._findStatusIcon = this.getElement("find-status-icon");
         this._findStatusDesc = this.getElement("find-status");
 
+        this._foundLink = null;
+        this._foundEditable = null;
+        this._currentWindow = null;
+
         var prefsvc =
           Components.classes["@mozilla.org/preferences-service;1"]
                     .getService(Components.interfaces.nsIPrefBranch);