From 4b1c4393e9db0283f0b4577d50108c5cdcc40b5e Mon Sep 17 00:00:00 2001
From: "Olli.Pettay%helsinki.fi" <Olli.Pettay%helsinki.fi>
Date: Mon, 18 Sep 2006 08:47:06 +0000
Subject: [PATCH] Bug 349931, crashes during drag-and-drop, r+sr=roc

---
 layout/generic/nsFrame.cpp     | 34 ++++++++++++++++++++++++----------
 layout/generic/nsSelection.cpp |  3 ++-
 2 files changed, 26 insertions(+), 11 deletions(-)

diff --git a/layout/generic/nsFrame.cpp b/layout/generic/nsFrame.cpp
index c47d7753f02e..94b16b9fd4d6 100644
--- a/layout/generic/nsFrame.cpp
+++ b/layout/generic/nsFrame.cpp
@@ -2089,12 +2089,20 @@ NS_IMETHODIMP nsFrame::HandleDrag(nsPresContext* aPresContext,
   }
   nsIPresShell *presShell = aPresContext->PresShell();
 
-  nsFrameSelection* frameselection = GetFrameSelection();
+  nsCOMPtr<nsFrameSelection> frameselection = GetFrameSelection();
   PRBool mouseDown = frameselection->GetMouseDownState();
   if (!mouseDown)
     return NS_OK;
 
   frameselection->StopAutoScrollTimer();
+
+  // If we have capturing view, it must be ensured that |this| doesn't 
+  // get deleted during HandleDrag.
+  nsWeakFrame weakFrame = GetNearestCapturingView(this) ? this : nsnull;
+#ifdef NS_DEBUG
+  PRBool frameAlive = weakFrame.IsAlive();
+#endif
+
   // Check if we are dragging in a table cell
   nsCOMPtr<nsIContent> parentContent;
   PRInt32 contentOffset;
@@ -2112,16 +2120,22 @@ NS_IMETHODIMP nsFrame::HandleDrag(nsPresContext* aPresContext,
     frameselection->HandleDrag(this, pt);
   }
 
-  nsIView* captureView = GetNearestCapturingView(this);
-  if (captureView) {
-    // Get the view that aEvent->point is relative to. This is disgusting.
-    nsIView* eventView = nsnull;
-    nsPoint pt = nsLayoutUtils::GetEventCoordinatesForNearestView(aEvent, this,
-                                                                  &eventView);
-    nsPoint capturePt = pt + eventView->GetOffsetTo(captureView);
-    frameselection->StartAutoScrollTimer(captureView, capturePt, 30);
+  if (weakFrame) {
+    nsIView* captureView = GetNearestCapturingView(this);
+    if (captureView) {
+      // Get the view that aEvent->point is relative to. This is disgusting.
+      nsIView* eventView = nsnull;
+      nsPoint pt = nsLayoutUtils::GetEventCoordinatesForNearestView(aEvent, this,
+                                                                    &eventView);
+      nsPoint capturePt = pt + eventView->GetOffsetTo(captureView);
+      frameselection->StartAutoScrollTimer(captureView, capturePt, 30);
+    }
   }
-
+#ifdef NS_DEBUG
+  if (frameAlive && !weakFrame.IsAlive()) {
+    NS_WARNING("nsFrame deleted during nsFrame::HandleDrag.");
+  }
+#endif
   return NS_OK;
 }
 
diff --git a/layout/generic/nsSelection.cpp b/layout/generic/nsSelection.cpp
index cd1e013130eb..1a01ddf2ac70 100644
--- a/layout/generic/nsSelection.cpp
+++ b/layout/generic/nsSelection.cpp
@@ -7467,6 +7467,7 @@ nsTypedSelection::NotifySelectionListeners()
     return NS_OK;
   }
   PRInt32 cnt = mSelectionListeners.Count();
+  nsCOMArray<nsISelectionListener> selectionListeners(mSelectionListeners);
   
   nsCOMPtr<nsIDOMDocument> domdoc;
   nsCOMPtr<nsIPresShell> shell;
@@ -7476,7 +7477,7 @@ nsTypedSelection::NotifySelectionListeners()
   short reason = mFrameSelection->PopReason();
   for (PRInt32 i = 0; i < cnt; i++)
   {
-    nsISelectionListener* thisListener = mSelectionListeners[i];
+    nsISelectionListener* thisListener = selectionListeners[i];
     if (thisListener)
       thisListener->NotifySelectionChanged(domdoc, this, reason);
   }