Clear the prescontext property table when we tear down the frame tree so that

we don't try to destroy frames after the arena they come from has been
deallocated.  Bug 317855, r+sr=roc

content/base/src/nsPropertyTable.cpp

@@ -107,16 +107,15 @@ private:
   PtrBits            mBits;           // pointer to pass to dtor or category
 };
 
-nsPropertyTable::~nsPropertyTable()
+void
+nsPropertyTable::DeleteAllProperties()
 {
-  if (mPropertyList) {
-    while (mPropertyList) {
-      PropertyList* tmp = mPropertyList;
+  while (mPropertyList) {
+    PropertyList* tmp = mPropertyList;
 
-      mPropertyList = mPropertyList->mNext;
-      tmp->Destroy();
-      delete tmp;
-    }
+    mPropertyList = mPropertyList->mNext;
+    tmp->Destroy();
+    delete tmp;
   }
 }
 

content/base/src/nsPropertyTable.h

@@ -206,7 +206,15 @@ class nsPropertyTable
   NS_HIDDEN_(void) Enumerate(const void *aObject, PRUint32 aCategory,
                              NSPropertyFunc aCallback, void *aData);
 
-  ~nsPropertyTable() NS_HIDDEN;
+  /**
+   * Deletes all of the properties for all objects in the property
+   * table, calling the destructor function for each property.
+   */
+  NS_HIDDEN_(void) DeleteAllProperties();
+  
+  ~nsPropertyTable() {
+    DeleteAllProperties();
+  }
 
   struct PropertyList;
 

layout/base/nsPresShell.cpp

@@ -1854,10 +1854,17 @@ PresShell::Destroy()
   // Let the style set do its cleanup.
   mStyleSet->Shutdown(mPresContext);
 
-  // We hold a reference to the pres context, and it holds a weak link back
-  // to us. To avoid the pres context having a dangling reference, set its 
-  // pres shell to NULL
   if (mPresContext) {
+    // Clear out the prescontext's property table -- since our frame tree is
+    // now dead, we shouldn't be looking up any more properties in that table.
+    // We want to do this before we call SetShell() on the prescontext, so
+    // property destructors can usefully call GetPresShell() on the
+    // prescontext.
+    mPresContext->PropertyTable()->DeleteAllProperties();
+
+    // We hold a reference to the pres context, and it holds a weak link back
+    // to us. To avoid the pres context having a dangling reference, set its 
+    // pres shell to NULL
     mPresContext->SetShell(nsnull);
 
     // Clear the link handler (weak reference) as well