Null-check the root pres context result. Unregister the plugin frame earlier, at Stop instead of Destroy time. b=521426 r=roc

layout/base/nsCSSFrameConstructor.cpp

@@ -7502,7 +7502,10 @@ nsCSSFrameConstructor::ProcessRestyledFrames(nsStyleChangeList& aChangeList)
     // can require plugin clipping to change. If we requested a reflow,
     // we don't need to do this since the reflow will do it for us.
     nsIFrame* rootFrame = mPresShell->FrameManager()->GetRootFrame();
-    presContext->RootPresContext()->UpdatePluginGeometry(rootFrame);
+    nsRootPresContext* rootPC = presContext->GetRootPresContext();
+    if (rootPC) {
+      rootPC->UpdatePluginGeometry(rootFrame);
+    }
   }
 
   // cleanup references and verify the style tree.  Note that the latter needs

layout/base/nsCaret.cpp

@@ -991,10 +991,13 @@ void nsCaret::GetViewForRendering(nsIFrame *caretFrame,
     if (outRelativeView && coordType == eTopLevelWindowCoordinates) {
       nsCOMPtr<nsIPresShell> presShell = do_QueryReferent(mPresShell);
       if (presShell) {
-        nsIViewManager* vm =
-          presShell->GetPresContext()->RootPresContext()->PresShell()->GetViewManager();
-        if (vm) {
-          vm->GetRootView(*outRelativeView);
+        nsRootPresContext* rootPC =
+          presShell->GetPresContext()->GetRootPresContext();
+        if (rootPC) {
+          nsIViewManager* vm = rootPC->PresShell()->GetViewManager();
+          if (vm) {
+            vm->GetRootView(*outRelativeView);
+          }
         }
       }
     }

layout/base/nsPresContext.cpp

@@ -1050,7 +1050,7 @@ nsPresContext::Observe(nsISupports* aSubject,
 
 // We may want to replace this with something faster, maybe caching the root prescontext
 nsRootPresContext*
-nsPresContext::RootPresContext()
+nsPresContext::GetRootPresContext()
 {
   nsPresContext* pc = this;
   for (;;) {
@@ -1064,7 +1064,7 @@ nsPresContext::RootPresContext()
         }
       }
     }
-    return static_cast<nsRootPresContext*>(pc);
+    return pc->IsRoot() ? static_cast<nsRootPresContext*>(pc) : nsnull;
   }
 }
 

layout/base/nsPresContext.h

@@ -213,9 +213,13 @@ public:
 
   nsIPresShell* GetPresShell() const { return mShell; }
 
-  // Find the prescontext for the root of the view manager hierarchy that contains
-  // this prescontext.
-  nsRootPresContext* RootPresContext();
+  /**
+   * Return the presentation context for the root of the view manager
+   * hierarchy that contains this presentation context, or nsnull if it can't
+   * be found (e.g. it's detached).
+   */
+  nsRootPresContext* GetRootPresContext();
+  virtual PRBool IsRoot() { return PR_FALSE; }
 
   nsIDocument* Document() const
   {
@@ -1175,6 +1179,8 @@ public:
    */
   void DidApplyPluginGeometryUpdates();
 
+  virtual PRBool IsRoot() { return PR_TRUE; }
+
 private:
   nsTHashtable<nsPtrHashKey<nsObjectFrame> > mRegisteredPlugins;
 };

layout/base/nsPresShell.cpp

@@ -4562,7 +4562,10 @@ PresShell::UnsuppressAndInvalidate()
       mCaret->CheckCaretDrawingState();
     }
 
-    mPresContext->RootPresContext()->UpdatePluginGeometry(rootFrame);
+    nsRootPresContext* rootPC = mPresContext->GetRootPresContext();
+    if (rootPC) {
+      rootPC->UpdatePluginGeometry(rootFrame);
+    }
   }
 
   // now that painting is unsuppressed, focus may be set on the document
@@ -6118,8 +6121,8 @@ PresShell::HandleEvent(nsIView         *aView,
       return NS_OK;
 
     nsPresContext* framePresContext = frame->PresContext();
-    nsPresContext* rootPresContext = framePresContext->RootPresContext();
-    NS_ASSERTION(rootPresContext == mPresContext->RootPresContext(),
+    nsPresContext* rootPresContext = framePresContext->GetRootPresContext();
+    NS_ASSERTION(rootPresContext == mPresContext->GetRootPresContext(),
                  "How did we end up outside the connected prescontext/viewmanager hierarchy?"); 
     // If we aren't starting our event dispatch from the root frame of the root prescontext,
     // then someone must be capturing the mouse. In that case we don't want to search the popup
@@ -6638,8 +6641,13 @@ PresShell::AdjustContextMenuKeyEvent(nsMouseEvent* aEvent)
   // Use the root view manager's widget since it's most likely to have one,
   // and the coordinates returned by GetCurrentItemAndPositionForElement
   // are relative to the root of the root view manager.
-  mPresContext->RootPresContext()->PresShell()->GetViewManager()->
-    GetRootWidget(getter_AddRefs(aEvent->widget));
+  nsRootPresContext* rootPC = mPresContext->GetRootPresContext();
+  if (rootPC) {
+    rootPC->PresShell()->GetViewManager()->
+      GetRootWidget(getter_AddRefs(aEvent->widget));
+  } else {
+    aEvent->widget = nsnull;
+  }
   aEvent->refPoint.x = 0;
   aEvent->refPoint.y = 0;
 
@@ -7360,7 +7368,10 @@ PresShell::DoReflow(nsIFrame* target, PRBool aInterruptible)
     PostReflowEvent();
   }
 
-  mPresContext->RootPresContext()->UpdatePluginGeometry(target);
+  nsRootPresContext* rootPC = mPresContext->GetRootPresContext();
+  if (rootPC) {
+    rootPC->UpdatePluginGeometry(target);
+  }
 
   return !interrupted;
 }

layout/generic/nsGfxScrollFrame.cpp

@@ -1614,7 +1614,11 @@ CanScrollWithBlitting(nsIFrame* aFrame)
 
 void nsGfxScrollFrameInner::ScrollVisual(nsIntPoint aPixDelta)
 {
-  nsRootPresContext* rootPresContext = mOuter->PresContext()->RootPresContext();
+  nsRootPresContext* rootPresContext =
+    mOuter->PresContext()->GetRootPresContext();
+  if (!rootPresContext) {
+    return;
+  }
 
   nsPoint offsetToView;
   nsPoint offsetToWidget;

layout/generic/nsObjectFrame.cpp

@@ -615,8 +615,6 @@ nsObjectFrame::DestroyFrom(nsIFrame* aDestructRoot)
                (mContent && mContent->GetCurrentDoc()->GetDisplayDocument()),
                "about to crash due to bug 136927");
 
-  PresContext()->RootPresContext()->UnregisterPluginForGeometryUpdates(this);
-
   // we need to finish with the plugin before native window is destroyed
   // doing this in the destructor is too late.
   StopPluginInternal(PR_TRUE);
@@ -695,6 +693,9 @@ nsObjectFrame::CreateWidget(nscoord aWidth,
   viewMan->MoveViewTo(view, origin.x, origin.y);
 
   if (!aViewOnly && !mWidget && usewidgets) {
+    nsRootPresContext* rpc = PresContext()->GetRootPresContext();
+    if (!rpc)
+      return NS_ERROR_FAILURE;
     mInnerView = viewMan->CreateView(GetContentRect() - GetPosition(), view);
     if (!mInnerView) {
       NS_ERROR("Could not create inner view");
@@ -707,7 +708,6 @@ nsObjectFrame::CreateWidget(nscoord aWidth,
     if (NS_FAILED(rv))
       return rv;
 
-    nsRootPresContext* rpc = PresContext()->RootPresContext();
     // XXX this breaks plugins in popups ... do we care?
     nsIWidget* parentWidget =
       rpc->PresShell()->FrameManager()->GetRootFrame()->GetWindow();
@@ -1191,16 +1191,18 @@ nsObjectFrame::ComputeWidgetGeometry(const nsRegion& aRegion,
   if (!mWidget)
     return;
 
-  nsIWidget::Configuration* configuration =
-    aConfigurations->AppendElement();
+  nsPresContext* presContext = PresContext();
+  nsRootPresContext* rootPC = presContext->GetRootPresContext();
+  if (!rootPC)
+    return;
+
+  nsIWidget::Configuration* configuration = aConfigurations->AppendElement();
   if (!configuration)
     return;
   configuration->mChild = mWidget;
 
-  nsPresContext* presContext = PresContext();
   PRInt32 appUnitsPerDevPixel = presContext->AppUnitsPerDevPixel();
-  nsIFrame* rootFrame =
-    presContext->RootPresContext()->PresShell()->FrameManager()->GetRootFrame();
+  nsIFrame* rootFrame = rootPC->PresShell()->FrameManager()->GetRootFrame();
   nsRect bounds = GetContentRect() + GetParent()->GetOffsetTo(rootFrame);
   configuration->mBounds = bounds.ToNearestPixels(appUnitsPerDevPixel);
 
@@ -2254,6 +2256,12 @@ nsObjectFrame::StopPluginInternal(PRBool aDelayedStop)
     return;
   }
 
+  if (mWidget) {
+    nsRootPresContext* rootPC = PresContext()->GetRootPresContext();
+    NS_ASSERTION(rootPC, "unable to unregister the plugin frame");
+    rootPC->UnregisterPluginForGeometryUpdates(this);
+  }
+
   // Transfer the reference to the instance owner onto the stack so
   // that if we do end up re-entering this code, or if we unwind back
   // here witha deleted frame (this), we can still continue to stop

layout/generic/nsSelection.cpp

@@ -4645,8 +4645,10 @@ nsTypedSelection::DoAutoScroll(nsIFrame *aFrame, nsPoint& aPoint)
     result = mAutoScrollTimer->Stop();
 
   nsPresContext* presContext = aFrame->PresContext();
-  nsIFrame* rootmostFrame =
-    presContext->RootPresContext()->PresShell()->FrameManager()->GetRootFrame();
+  nsRootPresContext* rootPC = presContext->GetRootPresContext();
+  if (!rootPC)
+    return NS_OK;
+  nsIFrame* rootmostFrame = rootPC->PresShell()->FrameManager()->GetRootFrame();
   nsPoint globalPoint = aPoint + aFrame->GetOffsetTo(rootmostFrame);
 
   PRBool didScroll = presContext->PresShell()->

layout/xul/base/src/nsXULPopupManager.cpp

@@ -350,7 +350,9 @@ nsXULPopupManager::SetTriggerEvent(nsIDOMEvent* aEvent, nsIContent* aPopup)
           nsIPresShell* presShell = doc->GetPrimaryShell();
           if (presShell && presShell->GetPresContext()) {
             nsPresContext* rootDocPresContext =
-                presShell->GetPresContext()->RootPresContext();
+              presShell->GetPresContext()->GetRootPresContext();
+            if (!rootDocPresContext)
+              return;
             nsIFrame* rootDocumentRootFrame = rootDocPresContext->
                 PresShell()->FrameManager()->GetRootFrame();
             if ((event->eventStructType == NS_MOUSE_EVENT || 
@@ -1020,8 +1022,14 @@ nsXULPopupManager::FirePopupShowingEvent(nsIContent* aPopup,
 
   // coordinates are relative to the root widget
   nsPresContext* rootPresContext =
-    presShell->GetPresContext()->RootPresContext();
-  rootPresContext->PresShell()->GetViewManager()->GetRootWidget(getter_AddRefs(event.widget));
+    presShell->GetPresContext()->GetRootPresContext();
+  if (rootPresContext) {
+    rootPresContext->PresShell()->GetViewManager()->
+      GetRootWidget(getter_AddRefs(event.widget));
+  }
+  else {
+    event.widget = nsnull;
+  }
 
   event.refPoint = mCachedMousePoint;
   nsEventDispatcher::Dispatch(aPopup, aPresContext, &event, nsnull, &status);