Bug 305041 shutdown crash [@ nsAttrValue::ToString] nsAttrValue::sEnumTableArray is null

r=bz sr=bz

content/base/src/nsDOMAttribute.cpp

@@ -48,6 +48,7 @@
 #include "nsIDOMDocument.h"
 
 //----------------------------------------------------------------------
+PRBool nsDOMAttribute::sInitialized;
 
 nsDOMAttribute::nsDOMAttribute(nsDOMAttributeMap *aAttrMap,
                                nsINodeInfo       *aNodeInfo,
@@ -87,11 +88,10 @@ NS_INTERFACE_MAP_END
 NS_IMPL_ADDREF(nsDOMAttribute)
 NS_IMPL_RELEASE(nsDOMAttribute)
 
-
 void
 nsDOMAttribute::SetMap(nsDOMAttributeMap *aMap)
 {
-  if (mAttrMap && !aMap) {
+  if (mAttrMap && !aMap && sInitialized) {
     // We're breaking a relationship with content and not getting a new one,
     // need to locally cache value. GetValue() does that.
     nsAutoString tmp;
@@ -726,6 +726,18 @@ nsDOMAttribute::UnsetProperty(nsIAtom* aPropertyName, nsresult* aStatus)
   return doc->PropertyTable()->UnsetProperty(this, aPropertyName, aStatus);
 }
 
+void
+nsDOMAttribute::Initialize()
+{
+  sInitialized = PR_TRUE;
+}
+
+void
+nsDOMAttribute::Shutdown()
+{
+  sInitialized = PR_FALSE;
+}
+
 //----------------------------------------------------------------------
 
 nsAttributeChildList::nsAttributeChildList(nsDOMAttribute* aAttribute)

content/base/src/nsDOMAttribute.h

@@ -102,6 +102,11 @@ public:
   virtual nsresult DeleteProperty(nsIAtom  *aPropertyName);
   virtual void*    UnsetProperty(nsIAtom *aPropertyName,
                                  nsresult *aStatus = nsnull);
+  static void Initialize();
+  static void Shutdown();
+
+protected:
+  static PRBool sInitialized;
 
 private:
   nsString mValue;

layout/build/nsLayoutModule.cpp

@@ -146,6 +146,7 @@
 #include "nsIControllerContext.h"
 #include "nsDOMScriptObjectFactory.h"
 #include "nsAutoCopyListener.h"
+#include "nsDOMAttribute.h"
 
 #include "nsHTMLCanvasFrame.h"
 
@@ -335,6 +336,7 @@ Initialize(nsIModule* aSelf)
 
     return rv;
   }
+  nsDOMAttribute::Initialize();
 
   // Add our shutdown observer.
   nsCOMPtr<nsIObserverService> observerService =
@@ -370,6 +372,7 @@ Shutdown()
 
   gInitialized = PR_FALSE;
 
+  nsDOMAttribute::Shutdown();
   nsRange::Shutdown();
   nsGenericElement::Shutdown();
   nsEventListenerManager::Shutdown();