Bug 378325, r+sr=roc

layout/base/nsPresShell.cpp

@@ -4589,15 +4589,16 @@ PresShell::FlushPendingNotifications(mozFlushType aType)
 
   NS_ASSERTION(!isSafeToFlush || mViewManager, "Must have view manager");
   if (isSafeToFlush && mViewManager) {
+    // Processing pending notifications can kill us, and some callers only
+    // hold weak refs when calling FlushPendingNotifications().  :(
+    nsCOMPtr<nsIPresShell> kungFuDeathGrip(this);
+
     // Style reresolves not in conjunction with reflows can't cause
     // painting or geometry changes, so don't bother with view update
     // batching if we only have style reresolve
     mViewManager->BeginUpdateViewBatch();
 
     if (aType & Flush_StyleReresolves) {
-      // Processing pending restyles can kill us, and some callers only
-      // hold weak refs when calling FlushPendingNotifications().  :(
-      nsCOMPtr<nsIPresShell> kungFuDeathGrip(this);
       mFrameConstructor->ProcessPendingRestyles();
       if (mIsDestroying) {
         // We no longer have a view manager and all that.
@@ -4610,6 +4611,12 @@ PresShell::FlushPendingNotifications(mozFlushType aType)
     if (aType & Flush_OnlyReflow) {
       mFrameConstructor->RecalcQuotesAndCounters();
       ProcessReflowCommands(PR_FALSE);
+      if (mIsDestroying) {
+        // We no longer have a view manager and all that.
+        // XXX FIXME: Except we're in the middle of a view update batch...  We
+        // need to address that somehow.  See bug 369165.
+        return NS_OK;
+      }
     }
 
     PRUint32 updateFlags = NS_VMREFRESH_NO_SYNC;