diff --git a/layout/base/nsPresContext.h b/layout/base/nsPresContext.h
index bc69bb1874c..8501cdb80fd 100644
--- a/layout/base/nsPresContext.h
+++ b/layout/base/nsPresContext.h
@@ -69,6 +69,7 @@
#include "nsTArray.h"
#include "nsAutoPtr.h"
#include "nsThreadUtils.h"
+#include "nsContentUtils.h"
class nsImageLoader;
#ifdef IBMBIDI
@@ -1088,6 +1089,8 @@ struct nsAutoLayoutPhase {
// Once bug 337957 is fixed this should become an NS_ASSERTION
NS_WARN_IF_FALSE(mPresContext->mLayoutPhaseCount[eLayoutPhase_FrameC] == 0,
"recurring into frame construction");
+ NS_ASSERTION(!nsContentUtils::IsSafeToRunScript(),
+ "constructing frames and scripts are not blocked");
break;
default:
break;
diff --git a/layout/xul/base/src/crashtests/495728-1.xul b/layout/xul/base/src/crashtests/495728-1.xul
new file mode 100644
index 00000000000..ee8498d054d
--- /dev/null
+++ b/layout/xul/base/src/crashtests/495728-1.xul
@@ -0,0 +1,239 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/layout/xul/base/src/crashtests/crashtests.list b/layout/xul/base/src/crashtests/crashtests.list
index 52378f80a54..d717fc293f6 100644
--- a/layout/xul/base/src/crashtests/crashtests.list
+++ b/layout/xul/base/src/crashtests/crashtests.list
@@ -50,3 +50,4 @@ load 467481-1.xul
load 470063-1.html
load 472189.xul
load 475133.html
+load 495728-1.xul
diff --git a/layout/xul/base/src/nsListBoxBodyFrame.cpp b/layout/xul/base/src/nsListBoxBodyFrame.cpp
index ecadf9ca699..442c3585aa5 100644
--- a/layout/xul/base/src/nsListBoxBodyFrame.cpp
+++ b/layout/xul/base/src/nsListBoxBodyFrame.cpp
@@ -816,9 +816,15 @@ nsListBoxBodyFrame::ScrollToIndex(PRInt32 aRowIndex)
mCurrentIndex = newIndex;
+ nsWeakFrame weak(this);
+
// Since we're going to flush anyway, we need to not do this off an event
DoInternalPositionChangedSync(up, delta);
+ if (!weak.IsAlive()) {
+ return NS_OK;
+ }
+
// This change has to happen immediately.
// Flush any pending reflow commands.
// XXXbz why, exactly?
@@ -869,7 +875,9 @@ nsListBoxBodyFrame::DoInternalPositionChangedSync(PRBool aUp, PRInt32 aDelta)
nsTArray< nsRefPtr > temp;
temp.SwapElements(mPendingPositionChangeEvents);
for (PRUint32 i = 0; i < temp.Length(); ++i) {
- temp[i]->Run();
+ if (weak.IsAlive()) {
+ temp[i]->Run();
+ }
temp[i]->Revoke();
}
@@ -886,6 +894,8 @@ nsListBoxBodyFrame::DoInternalPositionChanged(PRBool aUp, PRInt32 aDelta)
if (aDelta == 0)
return NS_OK;
+ nsAutoScriptBlocker scriptBlocker;
+
nsPresContext *presContext = PresContext();
nsBoxLayoutState state(presContext);