Bug 337586, Crash [@ PresShell::InitialReflow] when window gets destroyed duren beforeunload event handler, pressing reload, r+sr=bz

content/base/src/nsContentSink.cpp

@@ -835,7 +835,10 @@ nsContentSink::StartLayout(PRBool aIsFrameset)
 
       // Resize-reflow this time
       nsRect r = shell->GetPresContext()->GetVisibleArea();
-      shell->InitialReflow(r.width, r.height);
+      nsresult rv = shell->InitialReflow(r.width, r.height);
+      if (NS_FAILED(rv)) {
+        return;
+      }
 
       // Now trigger a refresh
       RefreshIfEnabled(shell->GetViewManager());

content/html/document/src/nsMediaDocument.cpp

@@ -275,7 +275,8 @@ nsMediaDocument::StartLayout()
 
     // Initial-reflow this time.
     nsRect visibleArea = shell->GetPresContext()->GetVisibleArea();
-    shell->InitialReflow(visibleArea.width, visibleArea.height);
+    nsresult rv = shell->InitialReflow(visibleArea.width, visibleArea.height);
+    NS_ENSURE_SUCCESS(rv, rv);
 
     // Now trigger a refresh.
     nsIViewManager* vm = shell->GetViewManager();

content/xul/document/src/nsXULDocument.cpp

@@ -1993,10 +1993,11 @@ nsXULDocument::StartLayout(void)
         // dropping dirty rects if refresh is disabled rather than
         // accumulating them until refresh is enabled and then
         // triggering a repaint...
+        nsresult rv = NS_OK;
         nsIViewManager* vm = shell->GetViewManager();
         if (vm) {
             nsCOMPtr<nsIContentViewer> contentViewer;
-            nsresult rv = docShell->GetContentViewer(getter_AddRefs(contentViewer));
+            rv = docShell->GetContentViewer(getter_AddRefs(contentViewer));
             if (NS_SUCCEEDED(rv) && (contentViewer != nsnull)) {
                 PRBool enabled;
                 contentViewer->GetEnableRendering(&enabled);
@@ -2006,7 +2007,8 @@ nsXULDocument::StartLayout(void)
             }
         }
 
-        shell->InitialReflow(r.width, r.height);
+        rv = shell->InitialReflow(r.width, r.height);
+        NS_ENSURE_SUCCESS(rv, rv);
 
         // Start observing the document _after_ we do the initial
         // reflow. Otherwise, we'll get into an trouble trying to

layout/base/nsPresShell.cpp

@@ -2726,6 +2726,7 @@ PresShell::GetDidInitialReflow(PRBool *aDidInitialReflow)
 NS_IMETHODIMP
 PresShell::InitialReflow(nscoord aWidth, nscoord aHeight)
 {
+  nsCOMPtr<nsIPresShell> kungFuDeathGrip(this);
   mDidInitialReflow = PR_TRUE;
 
 #ifdef NS_DEBUG
@@ -2784,6 +2785,10 @@ PresShell::InitialReflow(nscoord aWidth, nscoord aHeight)
     MOZ_TIMER_DEBUGLOG(("Stop: Frame Creation: PresShell::InitialReflow(), this=%p\n",
                         (void*)this));
     MOZ_TIMER_STOP(mFrameCreationWatch);
+
+    // Something in mFrameConstructor->ContentInserted may have caused
+    // Destroy() to get called, bug 337586.
+    NS_ENSURE_STATE(!mHaveShutDown);
   }
 
   if (rootFrame) {
@@ -7272,7 +7277,8 @@ PresShell::VerifyIncrementalReflow()
   sh->SetVerifyReflowEnable(PR_FALSE); // turn off verify reflow while we're reflowing the test frame tree
   NS_ASSERTION(NS_SUCCEEDED (rv), "failed to create presentation shell");
   vm->SetViewObserver((nsIViewObserver *)((PresShell*)sh));
-  sh->InitialReflow(r.width, r.height);
+  rv = sh->InitialReflow(r.width, r.height);
+  NS_ENSURE_SUCCESS(rv, rv);
   sh->SetVerifyReflowEnable(PR_TRUE);  // turn on verify reflow again now that we're done reflowing the test frame tree
   if (VERIFY_REFLOW_NOISY & gVerifyReflowFlags) {
      printf("Verification Tree built, comparing...\n");