Attempting to fix crashes in RetargetEventToParent (bug 303725). Leave a weak container pointer so that events targetted to cached pres shells can be sent up to the parent, and don't crash if this fails. r=aaronl, sr=dbaron.

layout/base/nsDocumentViewer.cpp

@@ -1226,6 +1226,9 @@ DocumentViewerImpl::Open(nsISupports *aState)
   if (mDocument)
     mDocument->SetContainer(nsCOMPtr<nsISupports>(do_QueryReferent(mContainer)));
 
+  if (mPresShell)
+    mPresShell->SetForwardingContainer(nsnull);
+
   SyncParentSubDocMap();
 
   // XXX re-enable image animations once that works correctly
@@ -1392,6 +1395,8 @@ DocumentViewerImpl::Destroy()
       mPresContext->SetLinkHandler(nsnull);
       mPresContext->SetContainer(nsnull);
     }
+    if (mPresShell)
+      mPresShell->SetForwardingContainer(mContainer);
 
     return NS_OK;
   }

layout/base/nsIPresShell.h

@@ -59,6 +59,7 @@
 #include "nsCOMArray.h"
 #include "nsFrameManagerBase.h"
 #include "mozFlushType.h"
+#include "nsWeakReference.h"
 #include <stdio.h> // for FILE definition
 
 class nsIAtom;
@@ -692,6 +693,16 @@ public:
    */
   virtual void Thaw() = 0;
 
+#ifdef _IMPL_NS_LAYOUT
+  /**
+   * When this shell is disconnected from its containing docshell, we
+   * lose our container pointer.  However, we'd still like to be able to target
+   * user events at the docshell's parent.  This pointer allows us to do that.
+   * It should not be used for any other purpose.
+   */
+  void SetForwardingContainer(nsISupports *aContainer);
+#endif
+
 protected:
   // IMPORTANT: The ownership implicit in the following member variables
   // has been explicitly checked.  If you add any members to this class,
@@ -706,6 +717,7 @@ protected:
   nsIViewManager*           mViewManager;   // [WEAK] docViewer owns it so I don't have to
   nsIFrameSelection*        mSelection;
   nsFrameManagerBase        mFrameManager;  // [OWNS]
+  nsWeakPtr                 mForwardingContainer;
 
   PRPackedBool              mStylesHaveChanged;
 

layout/base/nsPresShell.cpp

@@ -1630,6 +1630,12 @@ nsIPresShell::GetVerifyReflowFlags()
 #endif
 }
 
+void
+nsIPresShell::SetForwardingContainer(nsISupports *aContainer)
+{
+  mForwardingContainer = do_GetWeakReference(aContainer);
+}
+
 //----------------------------------------------------------------------
 
 nsresult
@@ -5944,9 +5950,16 @@ nsresult PresShell::RetargetEventToParent(nsIView         *aView,
   // Next, update the display so the old focus ring is no longer visible
 
   nsCOMPtr<nsISupports> container = mPresContext->GetContainer();
+  if (!container)
+    container = do_QueryReferent(mForwardingContainer);
 
   nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(container));
-  NS_ASSERTION(docShell, "No docshell for container.");
+  if (!docShell) {
+    // We don't have any place to send this event.
+    NS_WARNING("dropping event, no forwarding shell");
+    return NS_OK;
+  }
+
   nsCOMPtr<nsIContentViewer> contentViewer;
   docShell->GetContentViewer(getter_AddRefs(contentViewer));
   if (contentViewer) {