From 7e8cc37590eac1ddd24151e728434092bcf6d74b Mon Sep 17 00:00:00 2001
From: Olli Pettay <Olli.Pettay@helsinki.fi>
Date: Wed, 10 Nov 2010 23:15:21 +0200
Subject: [PATCH] Bug 610690 - Crash when printing many documents successively
 [@ nsCOMPtr_base::assign_from_qi | nsDocShell::SetTreeOwner ], r=mats,
 a=benjamin

---
 layout/printing/nsPrintObject.cpp | 8 ++++----
 layout/printing/nsPrintObject.h   | 2 ++
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/layout/printing/nsPrintObject.cpp b/layout/printing/nsPrintObject.cpp
index 4b9662132080..61caf9cee43c 100644
--- a/layout/printing/nsPrintObject.cpp
+++ b/layout/printing/nsPrintObject.cpp
@@ -43,7 +43,6 @@
 #include "nsPIDOMWindow.h"
 #include "nsGkAtoms.h"
 #include "nsComponentManagerUtils.h"
-#include "nsIDocShellTreeOwner.h"
 #include "nsIDocShellTreeItem.h"
 
 //---------------------------------------------------
@@ -66,10 +65,11 @@ nsPrintObject::~nsPrintObject()
   }
 
   DestroyPresentation();
+  mDocShell = nsnull;
+  mTreeOwner = nsnull; // mTreeOwner must be released after mDocShell; 
 }
 
 //------------------------------------------------------------------
-// Resets PO by destroying the presentation
 nsresult 
 nsPrintObject::Init(nsIDocShell* aDocShell, nsIDOMDocument* aDoc,
                     PRBool aPrintPreview)
@@ -79,7 +79,7 @@ nsPrintObject::Init(nsIDocShell* aDocShell, nsIDOMDocument* aDoc,
   if (mPrintPreview || mParent) {
     mDocShell = aDocShell;
   } else {
-    nsCOMPtr<nsIDocShellTreeOwner> owner = do_GetInterface(aDocShell);
+    mTreeOwner = do_GetInterface(aDocShell);
     nsCOMPtr<nsIDocShellTreeItem> item = do_QueryInterface(aDocShell);
     PRInt32 itemType = 0;
     item->GetItemType(&itemType);
@@ -88,7 +88,7 @@ nsPrintObject::Init(nsIDocShell* aDocShell, nsIDOMDocument* aDoc,
     NS_ENSURE_TRUE(mDocShell, NS_ERROR_OUT_OF_MEMORY);
     nsCOMPtr<nsIDocShellTreeItem> newItem = do_QueryInterface(mDocShell);
     newItem->SetItemType(itemType);
-    newItem->SetTreeOwner(owner);
+    newItem->SetTreeOwner(mTreeOwner);
   }
   NS_ENSURE_TRUE(mDocShell, NS_ERROR_FAILURE);
 
diff --git a/layout/printing/nsPrintObject.h b/layout/printing/nsPrintObject.h
index f00b61ed2213..a57839db7d4f 100644
--- a/layout/printing/nsPrintObject.h
+++ b/layout/printing/nsPrintObject.h
@@ -45,6 +45,7 @@
 #include "nsIViewManager.h"
 #include "nsIDocShell.h"
 #include "nsIDocument.h"
+#include "nsIDocShellTreeOwner.h"
 
 class nsPresContext;
 
@@ -70,6 +71,7 @@ public:
 
   // Data Members
   nsCOMPtr<nsIDocShell>    mDocShell;
+  nsCOMPtr<nsIDocShellTreeOwner> mTreeOwner;
   nsCOMPtr<nsIDocument>    mDocument;
 
   nsRefPtr<nsPresContext>  mPresContext;