fix 370967 - crash when focusing the input of an <isindex> and then reloading the document

(move the (mInputContent)->RemoveEventListenerByIID call from the destructor to Destroy() so that it actually gets called.)
r+sr=roc

layout/forms/nsIsIndexFrame.cpp

@@ -91,18 +91,18 @@ nsIsIndexFrame::nsIsIndexFrame(nsStyleContext* aContext) :
 
 nsIsIndexFrame::~nsIsIndexFrame()
 {
-  // remove ourself as a listener of the text control (bug 40533)
-  if (mInputContent) {
-    nsCOMPtr<nsIDOMEventReceiver> receiver(do_QueryInterface(mInputContent));
-    receiver->RemoveEventListenerByIID(this, NS_GET_IID(nsIDOMKeyListener));
-  }
 }
 
 void
 nsIsIndexFrame::Destroy()
 {
+  // remove ourself as a listener of the text control (bug 40533)
+  if (mInputContent) {
+    nsCOMPtr<nsIDOMEventReceiver> receiver(do_QueryInterface(mInputContent));
+    receiver->RemoveEventListenerByIID(this, NS_GET_IID(nsIDOMKeyListener));
+    nsContentUtils::DestroyAnonymousContent(&mInputContent);
+  }
   nsContentUtils::DestroyAnonymousContent(&mTextContent);
-  nsContentUtils::DestroyAnonymousContent(&mInputContent);
   nsContentUtils::DestroyAnonymousContent(&mPreHr);
   nsContentUtils::DestroyAnonymousContent(&mPostHr);
   nsAreaFrame::Destroy();