Fixing bug 100270. Crash when evaluating 'window.close();' in the JavaScript console. r=waterson@netscape.com, sr=hyatt@netscape.com

layout/base/nsCSSFrameConstructor.cpp

@@ -9736,6 +9736,8 @@ nsCSSFrameConstructor::AttributeChanged(nsIPresContext* aPresContext,
 {
   nsresult  result = NS_OK;
 
+  nsCOMPtr<nsIStyleFrameConstruction> kungFuDeathGrip(this);
+
   nsCOMPtr<nsIPresShell> shell;
   aPresContext->GetShell(getter_AddRefs(shell));
   nsIFrame*     primaryFrame;

layout/base/nsPresShell.cpp

@@ -5878,8 +5878,10 @@ PresShell::WillCauseReflow()
 
 nsresult
 PresShell::DidCauseReflow()
-{    
-  mViewManager->CacheWidgetChanges(PR_FALSE);
+{
+  if (mViewManager) {
+    mViewManager->CacheWidgetChanges(PR_FALSE);
+  }
 
   if (!gAsyncReflowDuringDocLoad && mDocumentLoading) {
     FlushPendingNotifications(PR_FALSE);

layout/html/base/src/nsPresShell.cpp

@@ -5878,8 +5878,10 @@ PresShell::WillCauseReflow()
 
 nsresult
 PresShell::DidCauseReflow()
-{    
-  mViewManager->CacheWidgetChanges(PR_FALSE);
+{
+  if (mViewManager) {
+    mViewManager->CacheWidgetChanges(PR_FALSE);
+  }
 
   if (!gAsyncReflowDuringDocLoad && mDocumentLoading) {
     FlushPendingNotifications(PR_FALSE);

layout/html/style/src/nsCSSFrameConstructor.cpp

@@ -9736,6 +9736,8 @@ nsCSSFrameConstructor::AttributeChanged(nsIPresContext* aPresContext,
 {
   nsresult  result = NS_OK;
 
+  nsCOMPtr<nsIStyleFrameConstruction> kungFuDeathGrip(this);
+
   nsCOMPtr<nsIPresShell> shell;
   aPresContext->GetShell(getter_AddRefs(shell));
   nsIFrame*     primaryFrame;