Prevent crash when IFRAME is reframed during layout. bug=108105 r=dbaron sr=jst

content/html/document/src/nsHTMLContentSink.cpp

@@ -2797,7 +2797,19 @@ HTMLContentSink::DidBuildModel(PRInt32 aQualityLevel)
     SINK_TRACE(SINK_TRACE_REFLOW,
                ("HTMLContentSink::DidBuildModel: forcing reflow on empty document"));
 
-    StartLayout();
+    // NOTE: only force the layout if we are NOT destroying the webshell. If we are destroying it, then 
+    //       starting layout will likely cause us to crash, or at best waste a lot of time as we are just
+    //       going to tear it down anyway.
+    PRBool bDestroying = PR_TRUE;
+    if (mWebShell) {
+      nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(mWebShell));
+      if (docShell) {
+        docShell->IsBeingDestroyed(&bDestroying);
+      }
+    }
+    if (!bDestroying) {
+      StartLayout();
+    }
   }
 
   ScrollToRef();

docshell/base/nsDocShell.cpp

@@ -5862,6 +5862,15 @@ nsDocShell::GetCanvasHasFocus(PRBool *aCanvasHasFocus)
   return NS_ERROR_FAILURE;
 }
 
+/* boolean IsBeingDestroyed (); */
+NS_IMETHODIMP 
+nsDocShell::IsBeingDestroyed(PRBool *aDoomed)
+{
+  NS_ENSURE_ARG(aDoomed);
+  *aDoomed = mIsBeingDestroyed;
+  return NS_OK;
+}
+
 //*****************************************************************************
 //***    nsRefreshTimer: Object Management
 //*****************************************************************************

docshell/base/nsIDocShell.idl

@@ -276,5 +276,10 @@ interface nsIDocShell : nsISupports
    * attribute to access the loadtype  for the document
    */
   attribute unsigned long  loadType;
+
+  /*
+   * returns true if the docshell is being destroyed, false otherwise
+   */
+  boolean IsBeingDestroyed();
 };