Disconnect the frame selection object from the pres shell earlier. b=421083 r+sr=roc a1.9=beltzner

layout/base/nsPresShell.cpp

@@ -1456,10 +1456,7 @@ PresShell::~PresShell()
 
   NS_IF_RELEASE(mPresContext);
   NS_IF_RELEASE(mDocument);
-  if (mSelection) {
-    mSelection->DisconnectFromPresShell();
-    NS_RELEASE(mSelection);
-  }
+  NS_IF_RELEASE(mSelection);
 }
 
 /**
@@ -1655,6 +1652,10 @@ PresShell::Destroy()
     mCaret = nsnull;
   }
   
+  if (mSelection) {
+    mSelection->DisconnectFromPresShell();
+  }
+
   // release our pref style sheet, if we have one still
   ClearPreferenceStyleRules();
 

layout/forms/nsTextControlFrame.cpp

@@ -1124,6 +1124,7 @@ nsTextControlFrame::PreDestroy()
   mSelCon = nsnull;
   if (mFrameSel) {
     mFrameSel->SetScrollableViewProvider(nsnull);
+    mFrameSel->DisconnectFromPresShell();
     mFrameSel = nsnull;
   }