Fixing crasher bug 138138. Clear the box object table in xul documents when a xul document is hidden since the box object table may contain references to non-refcounted frames that will be destroyed when the document is hidden. r=jkeiser@netscape.com, sr=heikki@netscape.com

content/base/src/nsDocumentViewer.cpp

@@ -2061,6 +2061,12 @@ DocumentViewerImpl::Hide(void)
   if (selPrivate && mSelectionListener)
     selPrivate->RemoveSelectionListener(mSelectionListener);
 
+  nsCOMPtr<nsIXULDocument> xul_doc(do_QueryInterface(mDocument));
+
+  if (xul_doc) {
+    xul_doc->ClearBoxObjectTable();
+  }
+
   mPresShell->Destroy();
 
   mPresShell     = nsnull;
@@ -2080,7 +2086,8 @@ DocumentViewerImpl::Hide(void)
 }
 
 nsresult
-DocumentViewerImpl::FindFrameSetWithIID(nsIContent * aParentContent, const nsIID& aIID)
+DocumentViewerImpl::FindFrameSetWithIID(nsIContent * aParentContent,
+                                        const nsIID& aIID)
 {
   PRInt32 numChildren;
   aParentContent->ChildCount(numChildren);

content/xul/document/public/nsIXULDocument.h

@@ -78,7 +78,7 @@ class nsIXULPrototypeDocument;
 class nsIXULDocument : public nsIXMLDocument
 {
 public:
-  static const nsIID& GetIID() { static nsIID iid = NS_IRDFDOCUMENT_IID; return iid; }
+  NS_DEFINE_STATIC_IID_ACCESSOR(NS_IRDFDOCUMENT_IID)
 
   // The resource-to-element map is a one-to-many mapping of RDF
   // resources to content elements.
@@ -165,6 +165,11 @@ public:
    * Callback from the content sink upon resumption from the parser.
    */
   NS_IMETHOD OnResumeContentSink() = 0;
+
+  /**
+   * Clear the box object hash
+   */
+  NS_IMETHOD ClearBoxObjectTable() = 0;
 };
 
 // factory functions

content/xul/document/src/nsXULDocument.cpp

@@ -1843,6 +1843,15 @@ nsXULDocument::OnResumeContentSink()
     return NS_OK;
 }
 
+NS_IMETHODIMP
+nsXULDocument::ClearBoxObjectTable()
+{
+    delete mBoxObjectTable;
+    mBoxObjectTable = nsnull;
+
+    return NS_OK;
+}
+
 static void PR_CALLBACK
 ClearBroadcasterMapEntry(PLDHashTable* aTable, PLDHashEntryHdr* aEntry)
 {

content/xul/document/src/nsXULDocument.h

@@ -369,7 +369,8 @@ public:
     NS_IMETHOD GetTemplateBuilderFor(nsIContent* aContent, nsIXULTemplateBuilder** aResult);
     NS_IMETHOD OnPrototypeLoadDone();
     NS_IMETHOD OnResumeContentSink();
-    
+    NS_IMETHOD ClearBoxObjectTable();
+
     // nsIDOMEventCapturer interface
     NS_IMETHOD    CaptureEvent(const nsAString& aType);
     NS_IMETHOD    ReleaseEvent(const nsAString& aType);

layout/base/nsDocumentViewer.cpp

@@ -2061,6 +2061,12 @@ DocumentViewerImpl::Hide(void)
   if (selPrivate && mSelectionListener)
     selPrivate->RemoveSelectionListener(mSelectionListener);
 
+  nsCOMPtr<nsIXULDocument> xul_doc(do_QueryInterface(mDocument));
+
+  if (xul_doc) {
+    xul_doc->ClearBoxObjectTable();
+  }
+
   mPresShell->Destroy();
 
   mPresShell     = nsnull;
@@ -2080,7 +2086,8 @@ DocumentViewerImpl::Hide(void)
 }
 
 nsresult
-DocumentViewerImpl::FindFrameSetWithIID(nsIContent * aParentContent, const nsIID& aIID)
+DocumentViewerImpl::FindFrameSetWithIID(nsIContent * aParentContent,
+                                        const nsIID& aIID)
 {
   PRInt32 numChildren;
   aParentContent->ChildCount(numChildren);