Fix bug 328839 by holding a safe weak ref to mPresShell. r=neil, sr=jst

layout/xul/base/src/nsBoxObject.cpp

@@ -135,7 +135,7 @@ NS_IMETHODIMP
 nsBoxObject::Init(nsIContent* aContent, nsIPresShell* aShell)
 {
   mContent = aContent;
-  mPresShell = aShell;
+  mPresShell = do_GetWeakReference(aShell);
   return NS_OK;
 }
 
@@ -144,7 +144,7 @@ nsBoxObject::SetDocument(nsIDocument* aDocument)
 {
   mPresState = nsnull;
   if (aDocument) {
-    mPresShell = aDocument->GetShellAt(0);
+    mPresShell = do_GetWeakReference(aDocument->GetShellAt(0));
   }
   else {
     mPresShell = nsnull;
@@ -163,11 +163,26 @@ nsBoxObject::InvalidatePresentationStuff()
 nsIFrame*
 nsBoxObject::GetFrame()
 {
-  if (!mPresShell)
+  nsCOMPtr<nsIPresShell> shell = GetPresShell();
+  if (!shell)
     return nsnull;
 
-  mPresShell->FlushPendingNotifications(Flush_Frames);
-  return mPresShell->GetPrimaryFrameFor(mContent);
+  // XXXbz should flush on document, no?  Except people call this from
+  // frame code, maybe?
+  shell->FlushPendingNotifications(Flush_Frames);
+  return shell->GetPrimaryFrameFor(mContent);
+}
+
+already_AddRefed<nsIPresShell>
+nsBoxObject::GetPresShell()
+{
+  if (!mPresShell) {
+    return nsnull;
+  }
+  
+  nsIPresShell* shell = nsnull;
+  CallQueryReferent(mPresShell.get(), &shell);
+  return shell;
 }
 
 nsresult 
@@ -551,10 +566,6 @@ nsBoxObject::GetDocShell(nsIDocShell** aResult)
 {
   *aResult = nsnull;
 
-  if (!mPresShell) {
-    return NS_OK;
-  }
-
   nsIFrame *frame = GetFrame();
 
   if (frame) {
@@ -572,8 +583,14 @@ nsBoxObject::GetDocShell(nsIDocShell** aResult)
   // No nsIFrameFrame available for mContent, try if there's a mapping
   // between mContent's document to mContent's subdocument.
 
-  nsIDocument *sub_doc =
-    mPresShell->GetDocument()->GetSubDocumentFor(mContent);
+  // XXXbz sXBL/XBL2 issue -- ownerDocument or currentDocument?
+  nsIDocument *doc = mContent->GetDocument();
+
+  if (!doc) {
+    return NS_OK;
+  }
+  
+  nsIDocument *sub_doc = doc->GetSubDocumentFor(mContent);
 
   if (!sub_doc) {
     return NS_OK;

layout/xul/base/src/nsBoxObject.h

@@ -41,6 +41,8 @@
 #include "nsPresState.h"
 #include "nsPoint.h"
 #include "nsAutoPtr.h"
+#include "nsIWeakReference.h"
+#include "nsIWeakReferenceUtils.h"
 
 class nsIBoxLayoutManager;
 class nsIBoxPaintManager;
@@ -63,6 +65,7 @@ public:
   NS_IMETHOD InvalidatePresentationStuff();
 
   virtual nsIFrame* GetFrame();
+  already_AddRefed<nsIPresShell> GetPresShell();
   nsresult GetOffsetRect(nsRect& aRect);
   nsresult GetScreenPosition(nsIntPoint& aPoint);
 
@@ -81,5 +84,5 @@ protected:
   nsAutoPtr<nsPresState> mPresState; // [OWNER]
 
   nsIContent* mContent; // [WEAK]
-  nsIPresShell* mPresShell; // [WEAK]
+  nsWeakPtr mPresShell;
 };

layout/xul/base/src/nsListBoxObject.cpp

@@ -208,12 +208,17 @@ nsListBoxObject::GetListBoxBody()
   if (!frame)
     return nsnull;
 
+  nsCOMPtr<nsIPresShell> shell = GetPresShell();
+  if (!shell) {
+    return nsnull;
+  }
+
   // Iterate over our content model children looking for the body.
   nsCOMPtr<nsIContent> content;
   FindBodyContent(frame->GetContent(), getter_AddRefs(content));
 
   // this frame will be a nsGFXScrollFrame
-  frame = mPresShell->GetPrimaryFrameFor(content);
+  frame = shell->GetPrimaryFrameFor(content);
   if (!frame)
      return nsnull;
   nsIScrollableFrame* scrollFrame;

layout/xul/base/src/nsPopupBoxObject.cpp

@@ -77,7 +77,12 @@ NS_IMPL_ISUPPORTS_INHERITED1(nsPopupBoxObject, nsBoxObject, nsIPopupBoxObject)
 nsIPopupSetFrame*
 nsPopupBoxObject::GetPopupSetFrame()
 {
-  nsIFrame* rootFrame = mPresShell->FrameManager()->GetRootFrame();
+  nsCOMPtr<nsIPresShell> shell = GetPresShell();
+  if (!shell) {
+    return nsnull;
+  }
+
+  nsIFrame* rootFrame = shell->FrameManager()->GetRootFrame();
   if (!rootFrame)
     return nsnull;
 

layout/xul/base/src/nsScrollBoxObject.cpp

@@ -89,8 +89,13 @@ NS_IMETHODIMP nsScrollBoxObject::ScrollTo(PRInt32 x, PRInt32 y)
   nsIScrollableView* scrollableView = GetScrollableView();
   if (!scrollableView)
     return NS_ERROR_FAILURE;
+
+  nsCOMPtr<nsIPresShell> shell = GetPresShell();
+  if (!shell) {
+    return NS_ERROR_UNEXPECTED;
+  }
   
-  float pixelsToTwips = mPresShell->GetPresContext()->PixelsToTwips();
+  float pixelsToTwips = shell->GetPresContext()->PixelsToTwips();
 
   return scrollableView->ScrollTo(NSToIntRound(x * pixelsToTwips),
                                   NSToIntRound(y * pixelsToTwips),
@@ -239,8 +244,13 @@ NS_IMETHODIMP nsScrollBoxObject::ScrollToElement(nsIDOMElement *child)
     if (!scrollableView)
        return NS_ERROR_FAILURE;
 
+    nsCOMPtr<nsIPresShell> shell = GetPresShell();
+    if (!shell) {
+      return NS_ERROR_UNEXPECTED;
+    }
+    
     // prepare for twips
-    float pixelsToTwips = mPresShell->GetPresContext()->PixelsToTwips();
+    float pixelsToTwips = shell->GetPresContext()->PixelsToTwips();
     
     nsIFrame* scrolledBox = GetScrolledBox(this);
     if (!scrolledBox)
@@ -307,7 +317,12 @@ NS_IMETHODIMP nsScrollBoxObject::GetPosition(PRInt32 *x, PRInt32 *y)
   if (NS_FAILED(rv))
     return rv;
 
-  float twipsToPixels = mPresShell->GetPresContext()->TwipsToPixels();
+  nsCOMPtr<nsIPresShell> shell = GetPresShell();
+  if (!shell) {
+    return NS_ERROR_UNEXPECTED;
+  }
+
+  float twipsToPixels = shell->GetPresContext()->TwipsToPixels();
 
   *x = NSToIntRound(xc * twipsToPixels);
   *y = NSToIntRound(yc * twipsToPixels);
@@ -323,7 +338,13 @@ NS_IMETHODIMP nsScrollBoxObject::GetScrolledSize(PRInt32 *width, PRInt32 *height
         return NS_ERROR_FAILURE;
         	
     nsRect scrollRect = scrolledBox->GetRect();
-    float twipsToPixels = mPresShell->GetPresContext()->TwipsToPixels();
+
+    nsCOMPtr<nsIPresShell> shell = GetPresShell();
+    if (!shell) {
+      return NS_ERROR_UNEXPECTED;
+    }
+
+    float twipsToPixels = shell->GetPresContext()->TwipsToPixels();
  
     *width  = NSTwipsToIntPixels(scrollRect.width, twipsToPixels);
     *height = NSTwipsToIntPixels(scrollRect.height, twipsToPixels);
@@ -339,9 +360,14 @@ NS_IMETHODIMP nsScrollBoxObject::EnsureElementIsVisible(nsIDOMElement *child)
     if (!scrollableView)
        return NS_ERROR_FAILURE;
 
+    nsCOMPtr<nsIPresShell> shell = GetPresShell();
+    if (!shell) {
+      return NS_ERROR_UNEXPECTED;
+    }
+
     // prepare for twips
     float pixelsToTwips = 0.0;
-    pixelsToTwips = mPresShell->GetPresContext()->PixelsToTwips();
+    pixelsToTwips = shell->GetPresContext()->PixelsToTwips();
     
     nsIFrame* scrolledBox = GetScrolledBox(this);
     if (!scrolledBox)

layout/xul/base/src/tree/src/nsTreeBoxObject.cpp

@@ -165,7 +165,12 @@ nsTreeBoxObject::GetTreeBody()
   nsCOMPtr<nsIContent> content;
   FindBodyElement(frame->GetContent(), getter_AddRefs(content));
 
-  frame = mPresShell->GetPrimaryFrameFor(content);
+  nsCOMPtr<nsIPresShell> shell = GetPresShell();
+  if (!shell) {
+    return nsnull;
+  }
+
+  frame = shell->GetPrimaryFrameFor(content);
   if (!frame)
      return nsnull;