Bug 806755 - Don't call scroll methods on the pres shell after the Selection was disconnected. r=roc

layout/generic/nsSelection.cpp

@@ -5327,6 +5327,10 @@ Selection::ScrollIntoView(SelectionRegion aRegion,
   if (!mFrameSelection)
     return NS_OK;//nothing to do
 
+  nsCOMPtr<nsIPresShell> presShell = mFrameSelection->GetShell();
+  if (!presShell)
+    return NS_OK;
+
   if (mFrameSelection->GetBatching())
     return NS_OK;
 
@@ -5334,11 +5338,6 @@ Selection::ScrollIntoView(SelectionRegion aRegion,
     return PostScrollSelectionIntoViewEvent(aRegion, aFlags,
       aVertical, aHorizontal);
 
-  nsCOMPtr<nsIPresShell> presShell;
-  nsresult result = GetPresShell(getter_AddRefs(presShell));
-  if (NS_FAILED(result) || !presShell)
-    return result;
-
   // Now that text frame character offsets are always valid (though not
   // necessarily correct), the worst that will happen if we don't flush here
   // is that some callers might scroll to the wrong place.  Those should
@@ -5347,10 +5346,10 @@ Selection::ScrollIntoView(SelectionRegion aRegion,
   if (aFlags & Selection::SCROLL_DO_FLUSH) {
     presShell->FlushPendingNotifications(Flush_Layout);
 
-    // Reget the presshell, since it might have gone away.
-    result = GetPresShell(getter_AddRefs(presShell));
-    if (NS_FAILED(result) || !presShell)
-      return result;
+    // Reget the presshell, since it might have been Destroy'ed.
+    presShell = mFrameSelection ? mFrameSelection->GetShell() : nullptr;
+    if (!presShell)
+      return NS_OK;
   }
 
   //