Fix crash due to orphaned editor anonymous content (bug 297926). r+sr=bzbarsky, a=bsmedberg

editor/libeditor/html/nsHTMLEditor.cpp

@@ -178,6 +178,16 @@ nsHTMLEditor::~nsHTMLEditor()
   nsCOMPtr<nsIEditActionListener> mListener = do_QueryInterface(mRules);
   RemoveEditActionListener(mListener);
   
+  // Clean up after our anonymous content -- we don't want these nodes to
+  // stay around (which they would, since the frames have an owning reference).
+
+  if (mAbsolutelyPositionedObject)
+    HideGrabber();
+  if (mInlineEditedCell)
+    HideInlineTableEditingUI();
+  if (mResizedObject)
+    HideResizers();
+
   //the autopointers will clear themselves up. 
   //but we need to also remove the listeners or we have a leak
   nsCOMPtr<nsISelection>selection;