Fix bug 400556 by tearing down editor a little earlier. r+sr=peterv

docshell/base/nsDocShell.cpp

@@ -1004,6 +1004,12 @@ nsDocShell::FirePageHideNotification(PRBool aIsUnload)
         }
     }
 
+    // Now make sure our editor, if any, is torn down before we go
+    // any farther.
+    if (mEditorData) {
+        mEditorData->TearDownEditor();
+    }
+
     return NS_OK;
 }
 

docshell/base/nsDocShellEditorData.cpp

@@ -67,6 +67,12 @@ nsDocShellEditorData::nsDocShellEditorData(nsIDocShell* inOwningDocShell)
 
 ----------------------------------------------------------------------------*/
 nsDocShellEditorData::~nsDocShellEditorData()
+{
+  TearDownEditor();
+}
+
+void
+nsDocShellEditorData::TearDownEditor()
 {
   if (mEditingSession)
   {

docshell/base/nsDocShellEditorData.h

@@ -66,7 +66,7 @@ public:
               ~nsDocShellEditorData();
               
 
-              // set a flag to say this frame should be editable when the next url loads
+  // set a flag to say this frame should be editable when the next url loads
   nsresult    MakeEditable(PRBool inWaitForUriLoad);
   
   PRBool      GetEditable();
@@ -84,6 +84,9 @@ public:
               // set the editor on this docShell
   nsresult    SetEditor(nsIEditor *inEditor);
 
+  // Tear down the editor on this docshell, if any.
+  void        TearDownEditor();
+
 protected:              
 
   nsresult    EnsureEditingSession();