Bug 421432. Don't crash when we ScrollToAnchor after UnsuppressPainting tore down the document. r+sr=dbaron,a=beltzner

layout/base/nsDocumentViewer.cpp

@@ -1009,9 +1009,12 @@ DocumentViewerImpl::LoadComplete(nsresult aStatus)
   // Now that the document has loaded, we can tell the presshell
   // to unsuppress painting.
   if (mPresShell && !mStopped) {
-    nsCOMPtr<nsIPresShell> shellDeathGrip(mPresShell); // bug 378682
+    nsCOMPtr<nsIPresShell> shellDeathGrip(mPresShell);
     mPresShell->UnsuppressPainting();
-    mPresShell->ScrollToAnchor();
+    // mPresShell could have been removed now, see bug 378682/421432
+    if (mPresShell) {
+      mPresShell->ScrollToAnchor();
+    }
   }
 
   nsJSContext::LoadEnd();