Fixes for 83027, 83892, and 80512. r/sr=blake,alecf,pink, sr=hewitt,blake, a=asa

content/xbl/src/nsXBLPrototypeBinding.cpp

@@ -1408,27 +1408,29 @@ nsXBLPrototypeBinding::NotifyBoundElements()
       nsCOMPtr<nsIDocument> doc;
       content->GetDocument(*getter_AddRefs(doc));
     
-      // Flush first
-      doc->FlushPendingNotifications();
+      if (doc) {
+        // Flush first
+        doc->FlushPendingNotifications();
 
-      // Notify
-      nsCOMPtr<nsIContent> parent;
-      content->GetParent(*getter_AddRefs(parent));
-      PRInt32 index = 0;
-      if (parent)
-        parent->IndexOf(content, index);
+        // Notify
+        nsCOMPtr<nsIContent> parent;
+        content->GetParent(*getter_AddRefs(parent));
+        PRInt32 index = 0;
+        if (parent)
+          parent->IndexOf(content, index);
         
-      nsCOMPtr<nsIPresShell> shell = getter_AddRefs(doc->GetShellAt(0));
-      if (shell) {
-        nsIFrame* childFrame;
-        shell->GetPrimaryFrameFor(content, &childFrame);
-        nsCOMPtr<nsIDocumentObserver> obs(do_QueryInterface(shell));
-        if (!childFrame)
-          obs->ContentInserted(doc, parent, content, index);
-      }
+        nsCOMPtr<nsIPresShell> shell = getter_AddRefs(doc->GetShellAt(0));
+        if (shell) {
+          nsIFrame* childFrame;
+          shell->GetPrimaryFrameFor(content, &childFrame);
+          nsCOMPtr<nsIDocumentObserver> obs(do_QueryInterface(shell));
+          if (!childFrame)
+            obs->ContentInserted(doc, parent, content, index);
+        }
 
-      // Flush again
-      doc->FlushPendingNotifications();
+        // Flush again
+        doc->FlushPendingNotifications();
+      }
     }
   }
 

layout/base/nsCSSFrameConstructor.cpp

@@ -8495,6 +8495,16 @@ nsCSSFrameConstructor::ContentInserted(nsIPresContext* aPresContext,
     nsIFrame* parentFrame = GetFrameFor(shell, aPresContext, aContainer);
 
     if (parentFrame) {
+      // See if we have an XBL insertion point.  If so, then see if the
+      // frame for it has been built yet.  If it hasn't been built yet,
+      // then we just bail.
+      nsCOMPtr<nsIFrameManager> frameManager;
+      shell->GetFrameManager(getter_AddRefs(frameManager));
+      nsIFrame* insertionPoint = nsnull;
+      frameManager->GetInsertionPoint(shell, parentFrame, aChild, &insertionPoint);
+      if (!insertionPoint)
+        return NS_OK; // Don't build the frames.
+
       // Find the frame that precedes the insertion point.
       nsIFrame* prevSibling = (aIndexInContainer == -1) ? 
                                FindPreviousAnonymousSibling(shell, aContainer, aChild) :

layout/base/nsPresShell.cpp

@@ -4456,7 +4456,8 @@ PresShell::UnsuppressAndInvalidate()
   mDocument->GetScriptGlobalObject(getter_AddRefs(globalObject));  
   nsCOMPtr<nsPIDOMWindow> ourWindow = do_QueryInterface(globalObject);
   nsCOMPtr<nsIFocusController> focusController;
-  ourWindow->GetRootFocusController(getter_AddRefs(focusController));
+  if (ourWindow)
+    ourWindow->GetRootFocusController(getter_AddRefs(focusController));
   if (focusController)
     // Suppress focus.  The act of tearing down the old content viewer
     // causes us to blur incorrectly.
@@ -4489,7 +4490,8 @@ PresShell::UnsuppressAndInvalidate()
     ((nsFrame*)rootFrame)->Invalidate(mPresContext, rect, PR_FALSE);
   }
 
-  CheckForFocus(ourWindow, focusController, mDocument);
+  if (ourWindow)
+    CheckForFocus(ourWindow, focusController, mDocument);
 
   if (focusController) // Unsuppress now that we've shown the new window and focused it.
     focusController->SetSuppressFocus(PR_FALSE, "PresShell suppression on Web page loads");

layout/html/base/src/nsPresShell.cpp

@@ -4456,7 +4456,8 @@ PresShell::UnsuppressAndInvalidate()
   mDocument->GetScriptGlobalObject(getter_AddRefs(globalObject));  
   nsCOMPtr<nsPIDOMWindow> ourWindow = do_QueryInterface(globalObject);
   nsCOMPtr<nsIFocusController> focusController;
-  ourWindow->GetRootFocusController(getter_AddRefs(focusController));
+  if (ourWindow)
+    ourWindow->GetRootFocusController(getter_AddRefs(focusController));
   if (focusController)
     // Suppress focus.  The act of tearing down the old content viewer
     // causes us to blur incorrectly.
@@ -4489,7 +4490,8 @@ PresShell::UnsuppressAndInvalidate()
     ((nsFrame*)rootFrame)->Invalidate(mPresContext, rect, PR_FALSE);
   }
 
-  CheckForFocus(ourWindow, focusController, mDocument);
+  if (ourWindow)
+    CheckForFocus(ourWindow, focusController, mDocument);
 
   if (focusController) // Unsuppress now that we've shown the new window and focused it.
     focusController->SetSuppressFocus(PR_FALSE, "PresShell suppression on Web page loads");

layout/html/style/src/nsCSSFrameConstructor.cpp

@@ -8495,6 +8495,16 @@ nsCSSFrameConstructor::ContentInserted(nsIPresContext* aPresContext,
     nsIFrame* parentFrame = GetFrameFor(shell, aPresContext, aContainer);
 
     if (parentFrame) {
+      // See if we have an XBL insertion point.  If so, then see if the
+      // frame for it has been built yet.  If it hasn't been built yet,
+      // then we just bail.
+      nsCOMPtr<nsIFrameManager> frameManager;
+      shell->GetFrameManager(getter_AddRefs(frameManager));
+      nsIFrame* insertionPoint = nsnull;
+      frameManager->GetInsertionPoint(shell, parentFrame, aChild, &insertionPoint);
+      if (!insertionPoint)
+        return NS_OK; // Don't build the frames.
+
       // Find the frame that precedes the insertion point.
       nsIFrame* prevSibling = (aIndexInContainer == -1) ? 
                                FindPreviousAnonymousSibling(shell, aContainer, aChild) :

layout/xul/base/src/nsMenuBarFrame.cpp

@@ -219,7 +219,8 @@ static void GetInsertionPoint(nsIPresShell* aShell, nsIFrame* aFrame, nsIFrame*
   nsCOMPtr<nsIFrameManager> frameManager;
   aShell->GetFrameManager(getter_AddRefs(frameManager));
   nsCOMPtr<nsIContent> child;
-  aChild->GetContent(getter_AddRefs(child));
+  if (aChild)
+    aChild->GetContent(getter_AddRefs(child));
   frameManager->GetInsertionPoint(aShell, aFrame, child, aResult);
 }
 

layout/xul/base/src/nsMenuPopupFrame.cpp

@@ -903,7 +903,8 @@ static void GetInsertionPoint(nsIPresShell* aShell, nsIFrame* aFrame, nsIFrame*
   nsCOMPtr<nsIFrameManager> frameManager;
   aShell->GetFrameManager(getter_AddRefs(frameManager));
   nsCOMPtr<nsIContent> child;
-  aChild->GetContent(getter_AddRefs(child));
+  if (aChild)
+    aChild->GetContent(getter_AddRefs(child));
   frameManager->GetInsertionPoint(aShell, aFrame, child, aResult);
 }