Bug 421432. Don't crash when we ScrollToAnchor after UnsuppressPainting tore down the document. r+sr=dbaron,a=beltzner

layout/base/nsDocumentViewer.cpp

@@ -1009,10 +1009,13 @@ DocumentViewerImpl::LoadComplete(nsresult aStatus)
   // Now that the document has loaded, we can tell the presshell
   // to unsuppress painting.
   if (mPresShell && !mStopped) {
-    nsCOMPtr<nsIPresShell> shellDeathGrip(mPresShell); // bug 378682
+    nsCOMPtr<nsIPresShell> shellDeathGrip(mPresShell);
     mPresShell->UnsuppressPainting();
+    // mPresShell could have been removed now, see bug 378682/421432
+    if (mPresShell) {
       mPresShell->ScrollToAnchor();
     }
+  }
 
   nsJSContext::LoadEnd();