Bug 1133629 IMEContentObserver should grab itself before using ContentEventHandler because it causes flushing pending layout r=smaug

dom/events/IMEContentObserver.cpp

@@ -430,10 +430,12 @@ IMEContentObserver::OnMouseButtonEvent(nsPresContext* aPresContext,
     default:
       return false;
   }
-  if (NS_WARN_IF(!mWidget)) {
+  if (NS_WARN_IF(!mWidget) || NS_WARN_IF(mWidget->Destroyed())) {
     return false;
   }
 
+  nsRefPtr<IMEContentObserver> kungFuDeathGrip(this);
+
   WidgetQueryContentEvent charAtPt(true, NS_QUERY_CHARACTER_AT_POINT,
                                    aMouseEvent->widget);
   charAtPt.refPoint = aMouseEvent->refPoint;
@@ -444,6 +446,12 @@ IMEContentObserver::OnMouseButtonEvent(nsPresContext* aPresContext,
     return false;
   }
 
+  // The widget might be destroyed during querying the content since it
+  // causes flushing layout.
+  if (!mWidget || NS_WARN_IF(mWidget->Destroyed())) {
+    return false;
+  }
+
   // The result character rect is relative to the top level widget.
   // We should notify it with offset in the widget.
   nsIWidget* topLevelWidget = mWidget->GetTopLevelWidget();