From effce48e94c327f9962f17e4531332039d221b22 Mon Sep 17 00:00:00 2001
From: "Olli.Pettay%helsinki.fi" <Olli.Pettay%helsinki.fi>
Date: Mon, 15 May 2006 17:51:35 +0000
Subject: [PATCH] Bug 337586, Crash [@ PresShell::InitialReflow] when window
 gets destroyed duren beforeunload event handler, pressing reload, r+sr=bz

---
 content/base/src/nsContentSink.cpp            | 5 ++++-
 content/html/document/src/nsMediaDocument.cpp | 3 ++-
 content/xul/document/src/nsXULDocument.cpp    | 6 ++++--
 layout/base/nsPresShell.cpp                   | 8 +++++++-
 4 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/content/base/src/nsContentSink.cpp b/content/base/src/nsContentSink.cpp
index 868a423e824..00b5066a49d 100644
--- a/content/base/src/nsContentSink.cpp
+++ b/content/base/src/nsContentSink.cpp
@@ -835,7 +835,10 @@ nsContentSink::StartLayout(PRBool aIsFrameset)
 
       // Resize-reflow this time
       nsRect r = shell->GetPresContext()->GetVisibleArea();
-      shell->InitialReflow(r.width, r.height);
+      nsresult rv = shell->InitialReflow(r.width, r.height);
+      if (NS_FAILED(rv)) {
+        return;
+      }
 
       // Now trigger a refresh
       RefreshIfEnabled(shell->GetViewManager());
diff --git a/content/html/document/src/nsMediaDocument.cpp b/content/html/document/src/nsMediaDocument.cpp
index 5668a6156fd..79c26a5e2e1 100644
--- a/content/html/document/src/nsMediaDocument.cpp
+++ b/content/html/document/src/nsMediaDocument.cpp
@@ -275,7 +275,8 @@ nsMediaDocument::StartLayout()
 
     // Initial-reflow this time.
     nsRect visibleArea = shell->GetPresContext()->GetVisibleArea();
-    shell->InitialReflow(visibleArea.width, visibleArea.height);
+    nsresult rv = shell->InitialReflow(visibleArea.width, visibleArea.height);
+    NS_ENSURE_SUCCESS(rv, rv);
 
     // Now trigger a refresh.
     nsIViewManager* vm = shell->GetViewManager();
diff --git a/content/xul/document/src/nsXULDocument.cpp b/content/xul/document/src/nsXULDocument.cpp
index 309539060be..913476dfeed 100644
--- a/content/xul/document/src/nsXULDocument.cpp
+++ b/content/xul/document/src/nsXULDocument.cpp
@@ -1993,10 +1993,11 @@ nsXULDocument::StartLayout(void)
         // dropping dirty rects if refresh is disabled rather than
         // accumulating them until refresh is enabled and then
         // triggering a repaint...
+        nsresult rv = NS_OK;
         nsIViewManager* vm = shell->GetViewManager();
         if (vm) {
             nsCOMPtr<nsIContentViewer> contentViewer;
-            nsresult rv = docShell->GetContentViewer(getter_AddRefs(contentViewer));
+            rv = docShell->GetContentViewer(getter_AddRefs(contentViewer));
             if (NS_SUCCEEDED(rv) && (contentViewer != nsnull)) {
                 PRBool enabled;
                 contentViewer->GetEnableRendering(&enabled);
@@ -2006,7 +2007,8 @@ nsXULDocument::StartLayout(void)
             }
         }
 
-        shell->InitialReflow(r.width, r.height);
+        rv = shell->InitialReflow(r.width, r.height);
+        NS_ENSURE_SUCCESS(rv, rv);
 
         // Start observing the document _after_ we do the initial
         // reflow. Otherwise, we'll get into an trouble trying to
diff --git a/layout/base/nsPresShell.cpp b/layout/base/nsPresShell.cpp
index f80e263d00d..f9c5aa18232 100644
--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@@ -2726,6 +2726,7 @@ PresShell::GetDidInitialReflow(PRBool *aDidInitialReflow)
 NS_IMETHODIMP
 PresShell::InitialReflow(nscoord aWidth, nscoord aHeight)
 {
+  nsCOMPtr<nsIPresShell> kungFuDeathGrip(this);
   mDidInitialReflow = PR_TRUE;
 
 #ifdef NS_DEBUG
@@ -2784,6 +2785,10 @@ PresShell::InitialReflow(nscoord aWidth, nscoord aHeight)
     MOZ_TIMER_DEBUGLOG(("Stop: Frame Creation: PresShell::InitialReflow(), this=%p\n",
                         (void*)this));
     MOZ_TIMER_STOP(mFrameCreationWatch);
+
+    // Something in mFrameConstructor->ContentInserted may have caused
+    // Destroy() to get called, bug 337586.
+    NS_ENSURE_STATE(!mHaveShutDown);
   }
 
   if (rootFrame) {
@@ -7272,7 +7277,8 @@ PresShell::VerifyIncrementalReflow()
   sh->SetVerifyReflowEnable(PR_FALSE); // turn off verify reflow while we're reflowing the test frame tree
   NS_ASSERTION(NS_SUCCEEDED (rv), "failed to create presentation shell");
   vm->SetViewObserver((nsIViewObserver *)((PresShell*)sh));
-  sh->InitialReflow(r.width, r.height);
+  rv = sh->InitialReflow(r.width, r.height);
+  NS_ENSURE_SUCCESS(rv, rv);
   sh->SetVerifyReflowEnable(PR_TRUE);  // turn on verify reflow again now that we're done reflowing the test frame tree
   if (VERIFY_REFLOW_NOISY & gVerifyReflowFlags) {
      printf("Verification Tree built, comparing...\n");