Clear the undisplayed content map before calling SetDocument(null), which can cause some XBL content to be destroyed without notifications, leaving dangling pointers in the undisplayed map. b=145737 r=bzbarsky sr=waterson

content/base/src/nsDocumentViewer.cpp

@@ -1618,6 +1618,17 @@ DocumentViewerImpl::Close()
     }
 #endif
 
+    // Before we clear the script global object, clear the undisplayed
+    // content map, since XBL content can be destroyed by the
+    // |SetDocument(null, ...)| triggered by calling
+    // |SetScriptGlobalObject(null)|.
+    if (mPresShell) {
+      nsCOMPtr<nsIFrameManager> frameManager;
+      mPresShell->GetFrameManager(getter_AddRefs(frameManager));
+      if (frameManager)
+        frameManager->ClearUndisplayedContentMap();
+    }
+
     // Break global object circular reference on the document created
     // in the DocViewer Init
     nsCOMPtr<nsIScriptGlobalObject> globalObject;

layout/base/nsDocumentViewer.cpp

@@ -1618,6 +1618,17 @@ DocumentViewerImpl::Close()
     }
 #endif
 
+    // Before we clear the script global object, clear the undisplayed
+    // content map, since XBL content can be destroyed by the
+    // |SetDocument(null, ...)| triggered by calling
+    // |SetScriptGlobalObject(null)|.
+    if (mPresShell) {
+      nsCOMPtr<nsIFrameManager> frameManager;
+      mPresShell->GetFrameManager(getter_AddRefs(frameManager));
+      if (frameManager)
+        frameManager->ClearUndisplayedContentMap();
+    }
+
     // Break global object circular reference on the document created
     // in the DocViewer Init
     nsCOMPtr<nsIScriptGlobalObject> globalObject;