Bug 491848. Ensure scripts are blocked during frame destruction. Also, don't dispatch paint events during a synchronous plugin message. r=roc

layout/base/nsDocumentViewer.cpp

@@ -4251,6 +4251,7 @@ DocumentViewerImpl::DestroyPresShell()
   if (selPrivate && mSelectionListener)
     selPrivate->RemoveSelectionListener(mSelectionListener);
 
+  nsAutoScriptBlocker scriptBlocker;
   mPresShell->Destroy();
   mPresShell = nsnull;
 }

layout/base/nsPresShell.cpp

@@ -1773,6 +1773,9 @@ PresShell::Init(nsIDocument* aDocument,
 NS_IMETHODIMP
 PresShell::Destroy()
 {
+  NS_ASSERTION(!nsContentUtils::IsSafeToRunScript(),
+    "destroy called on presshell while scripts not blocked");
+
 #ifdef MOZ_REFLOW_PERF
   DumpReflows();
   if (mReflowCountMgr) {

layout/generic/nsFrame.cpp

@@ -442,6 +442,9 @@ nsFrame::RemoveFrame(nsIAtom*        aListName,
 void
 nsFrame::Destroy()
 {
+  NS_ASSERTION(!nsContentUtils::IsSafeToRunScript(),
+    "destroy called on frame while scripts not blocked");
+
 #ifdef MOZ_SVG
   nsSVGEffects::InvalidateDirectRenderingObservers(this);
 #endif

layout/printing/nsPrintObject.cpp

@@ -38,6 +38,7 @@
 #include "nsPrintObject.h"
 #include "nsIContentViewer.h"
 #include "nsIDOMDocument.h"
+#include "nsContentUtils.h"
 
 //---------------------------------------------------
 //-- nsPrintObject Class Impl
@@ -93,6 +94,7 @@ nsPrintObject::DestroyPresentation()
   mPresContext = nsnull;
   if (mPresShell) {
     mPresShell->EndObservingDocument();
+    nsAutoScriptBlocker scriptBlocker;
     mPresShell->Destroy();
   }
   mPresShell   = nsnull;

widget/src/windows/nsWindow.cpp

@@ -5380,6 +5380,7 @@ nsWindow::ProcessMessageForPlugin(const MSG &aMsg,
   aCallDefWndProc = PR_FALSE;
   PRBool fallBackToNonPluginProcess = PR_FALSE;
   PRBool eventDispatched = PR_FALSE;
+  PRBool dispatchPendingEvents = PR_TRUE;
   switch (aMsg.message) {
     case WM_INPUTLANGCHANGEREQUEST:
     case WM_INPUTLANGCHANGE:
@@ -5422,7 +5423,12 @@ nsWindow::ProcessMessageForPlugin(const MSG &aMsg,
     case WM_IME_NOTIFY:
     case WM_IME_REQUEST:
     case WM_IME_SELECT:
+      break;
+
     case WM_IME_SETCONTEXT:
+      // Don't synchronously dispatch when we receive WM_IME_SETCONTEXT
+      // because we get it during plugin destruction. (bug 491848)
+      dispatchPendingEvents = PR_FALSE;
       break;
 
     default:
@@ -5431,7 +5437,8 @@ nsWindow::ProcessMessageForPlugin(const MSG &aMsg,
 
   if (!eventDispatched)
     aCallDefWndProc = !DispatchPluginEvent(aMsg);
-  DispatchPendingEvents();
+  if (dispatchPendingEvents)
+    DispatchPendingEvents();
   return PR_TRUE;
 }