Bug 338129, r=glazman, sr=neil

editor/libeditor/base/nsEditor.cpp

@@ -446,13 +446,6 @@ nsEditor::RemoveEventListeners()
                                     NS_GET_IID(nsIDOMDragListener));
     }
   }
-
-  mKeyListenerP = nsnull;
-  mMouseListenerP = nsnull;
-  mFocusListenerP = nsnull;
-  mTextListenerP = nsnull;
-  mCompositionListenerP = nsnull;
-  mDragListenerP = nsnull;
 }
 
 NS_IMETHODIMP

editor/libeditor/html/nsHTMLAbsPosition.cpp

@@ -316,9 +316,6 @@ nsHTMLEditor::HideGrabber()
   nsCOMPtr<nsIPresShell> ps = do_QueryReferent(mPresShellWeak);
   if (!ps) return NS_ERROR_NOT_INITIALIZED;
 
-  nsCOMPtr<nsIDocumentObserver> docObserver(do_QueryInterface(ps));
-  if (!docObserver) return NS_ERROR_FAILURE;
-
   // get the root content node.
 
   nsIDOMElement *rootElement = GetRoot();
@@ -326,9 +323,9 @@ nsHTMLEditor::HideGrabber()
   nsCOMPtr<nsIContent> rootContent = do_QueryInterface(rootElement);
   if (!rootContent) return NS_ERROR_NULL_POINTER;
 
-  DeleteRefToAnonymousNode(mGrabber, rootContent, docObserver);
+  DeleteRefToAnonymousNode(mGrabber, rootContent, ps);
   mGrabber = nsnull;
-  DeleteRefToAnonymousNode(mPositioningShadow, rootContent, docObserver);
+  DeleteRefToAnonymousNode(mPositioningShadow, rootContent, ps);
   mPositioningShadow = nsnull;
 
   return NS_OK;
@@ -425,9 +422,6 @@ nsHTMLEditor::EndMoving()
     nsCOMPtr<nsIPresShell> ps = do_QueryReferent(mPresShellWeak);
     if (!ps) return NS_ERROR_NOT_INITIALIZED;
 
-    nsCOMPtr<nsIDocumentObserver> docObserver(do_QueryInterface(ps));
-    if (!docObserver) return NS_ERROR_FAILURE;
-
     // get the root content node.
 
     nsIDOMElement *rootElement = GetRoot();
@@ -435,7 +429,7 @@ nsHTMLEditor::EndMoving()
     nsCOMPtr<nsIContent> rootContent( do_QueryInterface(rootElement) );
     if (!rootContent) return NS_ERROR_FAILURE;
 
-    DeleteRefToAnonymousNode(mPositioningShadow, rootContent, docObserver);
+    DeleteRefToAnonymousNode(mPositioningShadow, rootContent, ps);
     mPositioningShadow = nsnull;
   }
   nsCOMPtr<nsIDOMEventReceiver> erP = GetDOMEventReceiver();

editor/libeditor/html/nsHTMLAnonymousUtils.cpp

@@ -41,6 +41,7 @@
 #include "nsIDocument.h"
 #include "nsIEditor.h"
 #include "nsIPresShell.h"
+#include "nsPresContext.h"
 
 #include "nsISelection.h"
 
@@ -51,6 +52,7 @@
 
 #include "nsIDOMHTMLElement.h"
 #include "nsIDOMNSHTMLElement.h"
+#include "nsIDOMEventTarget.h"
 
 #include "nsIDOMCSSValue.h"
 #include "nsIDOMCSSPrimitiveValue.h"
@@ -165,11 +167,27 @@ nsHTMLEditor::CreateAnonymousElement(const nsAString & aTag, nsIDOMNode *  aPare
   return NS_OK;
 }
 
+// Removes event listener and calls DeleteRefToAnonymousNode.
+void
+nsHTMLEditor::RemoveListenerAndDeleteRef(const nsAString& aEvent,
+                                         nsIDOMEventListener* aListener,
+                                         PRBool aUseCapture,
+                                         nsIDOMElement* aElement,
+                                         nsIContent * aParentContent,
+                                         nsIPresShell* aShell)
+{
+  nsCOMPtr<nsIDOMEventTarget> evtTarget(do_QueryInterface(aElement));
+  if (evtTarget) {
+    evtTarget->RemoveEventListener(aEvent, aListener, aUseCapture);
+  }
+  DeleteRefToAnonymousNode(aElement, aParentContent, aShell);
+}
+
 // Deletes all references to an anonymous element
 void
 nsHTMLEditor::DeleteRefToAnonymousNode(nsIDOMElement* aElement,
-                                       nsIContent * aParentContent,
+                                       nsIContent* aParentContent,
-                                       nsIDocumentObserver * aDocObserver)
+                                       nsIPresShell* aShell)
 {
   // call ContentRemoved() for the anonymous content
   // node so its references get removed from the frame manager's
@@ -178,8 +196,17 @@ nsHTMLEditor::DeleteRefToAnonymousNode(nsIDOMElement* aElement,
   if (aElement) {
     nsCOMPtr<nsIContent> content = do_QueryInterface(aElement);
     if (content) {
-      aDocObserver->ContentRemoved(content->GetCurrentDoc(),
+      // Need to check whether aShell has been destroyed (but not yet deleted).
-				   aParentContent, content, -1);
+      // In that case presContext->GetPresShell() returns nsnull.
+      // See bug 338129.
+      if (aShell && aShell->GetPresContext() &&
+          aShell->GetPresContext()->GetPresShell() == aShell) {
+        nsCOMPtr<nsIDocumentObserver> docObserver = do_QueryInterface(aShell);
+        if (docObserver) {
+          docObserver->ContentRemoved(content->GetCurrentDoc(),
+                                      aParentContent, content, -1);
+        }
+      }
       content->UnbindFromTree();
     }
   }

editor/libeditor/html/nsHTMLEditor.h

@@ -792,9 +792,15 @@ public:
 protected:
 
   /* ANONYMOUS UTILS */
+  void     RemoveListenerAndDeleteRef(const nsAString& aEvent,
+                                      nsIDOMEventListener* aListener,
+                                      PRBool aUseCapture,
+                                      nsIDOMElement* aElement,
+                                      nsIContent* aParentContent,
+                                      nsIPresShell* aShell);
   void     DeleteRefToAnonymousNode(nsIDOMElement* aElement,
                                     nsIContent * aParentContent,
-                                    nsIDocumentObserver * aDocObserver);
+                                    nsIPresShell* aShell);
   nsresult GetElementOrigin(nsIDOMElement * aElement, PRInt32 & aX, PRInt32 & aY);
   nsresult GetPositionAndDimensions(nsIDOMElement * aElement,
                                     PRInt32 & aX, PRInt32 & aY,

editor/libeditor/html/nsHTMLInlineTableEditor.cpp

@@ -122,9 +122,6 @@ nsHTMLEditor::HideInlineTableEditingUI()
   nsCOMPtr<nsIPresShell> ps = do_QueryReferent(mPresShellWeak);
   if (!ps) return NS_ERROR_NOT_INITIALIZED;
 
-  nsCOMPtr<nsIDocumentObserver> docObserver(do_QueryInterface(ps));
-  if (!docObserver) return NS_ERROR_FAILURE;
-
   // get the root content node.
 
   nsIDOMElement *bodyElement = GetRoot();
@@ -132,17 +129,17 @@ nsHTMLEditor::HideInlineTableEditingUI()
   nsCOMPtr<nsIContent> bodyContent( do_QueryInterface(bodyElement) );
   if (!bodyContent) return NS_ERROR_FAILURE;
 
-  DeleteRefToAnonymousNode(mAddColumnBeforeButton, bodyContent, docObserver);
+  DeleteRefToAnonymousNode(mAddColumnBeforeButton, bodyContent, ps);
   mAddColumnBeforeButton = nsnull;
-  DeleteRefToAnonymousNode(mRemoveColumnButton, bodyContent, docObserver);
+  DeleteRefToAnonymousNode(mRemoveColumnButton, bodyContent, ps);
   mRemoveColumnButton = nsnull;
-  DeleteRefToAnonymousNode(mAddColumnAfterButton, bodyContent, docObserver);
+  DeleteRefToAnonymousNode(mAddColumnAfterButton, bodyContent, ps);
   mAddColumnAfterButton = nsnull;
-  DeleteRefToAnonymousNode(mAddRowBeforeButton, bodyContent, docObserver);
+  DeleteRefToAnonymousNode(mAddRowBeforeButton, bodyContent, ps);
   mAddRowBeforeButton = nsnull;
-  DeleteRefToAnonymousNode(mRemoveRowButton, bodyContent, docObserver);
+  DeleteRefToAnonymousNode(mRemoveRowButton, bodyContent, ps);
   mRemoveRowButton = nsnull;
-  DeleteRefToAnonymousNode(mAddRowAfterButton, bodyContent, docObserver);
+  DeleteRefToAnonymousNode(mAddRowAfterButton, bodyContent, ps);
   mAddRowAfterButton = nsnull;
 
   return NS_OK;

editor/libeditor/html/nsHTMLObjectResizer.cpp

@@ -425,9 +425,6 @@ nsHTMLEditor::HideResizers(void)
   nsCOMPtr<nsIPresShell> ps = do_QueryReferent(mPresShellWeak);
   if (!ps) return NS_ERROR_NOT_INITIALIZED;
 
-  nsCOMPtr<nsIDocumentObserver> docObserver(do_QueryInterface(ps));
-  if (!docObserver) return NS_ERROR_FAILURE;
-
   // get the root content node.
 
   nsIDOMElement *bodyElement = GetRoot();
@@ -435,25 +432,46 @@ nsHTMLEditor::HideResizers(void)
   nsCOMPtr<nsIContent> bodyContent( do_QueryInterface(bodyElement) );
   if (!bodyContent) return NS_ERROR_FAILURE;
 
-  DeleteRefToAnonymousNode(mTopLeftHandle, bodyContent, docObserver);
+  NS_NAMED_LITERAL_STRING(mousedown, "mousedown");
+  
+  RemoveListenerAndDeleteRef(mousedown, mMouseListenerP, PR_TRUE,
+                             mTopLeftHandle, bodyContent, ps);
   mTopLeftHandle = nsnull;
-  DeleteRefToAnonymousNode(mTopHandle, bodyContent, docObserver);
+
+  RemoveListenerAndDeleteRef(mousedown, mMouseListenerP, PR_TRUE,
+                             mTopHandle, bodyContent, ps);
   mTopHandle = nsnull;
-  DeleteRefToAnonymousNode(mTopRightHandle, bodyContent, docObserver);
+
+  RemoveListenerAndDeleteRef(mousedown, mMouseListenerP, PR_TRUE,
+                             mTopRightHandle, bodyContent, ps);
   mTopRightHandle = nsnull;
-  DeleteRefToAnonymousNode(mLeftHandle, bodyContent, docObserver);
+
+  RemoveListenerAndDeleteRef(mousedown, mMouseListenerP, PR_TRUE,
+                             mLeftHandle, bodyContent, ps);
   mLeftHandle = nsnull;
-  DeleteRefToAnonymousNode(mRightHandle, bodyContent, docObserver);
+
+  RemoveListenerAndDeleteRef(mousedown, mMouseListenerP, PR_TRUE,
+                             mRightHandle, bodyContent, ps);
   mRightHandle = nsnull;
-  DeleteRefToAnonymousNode(mBottomLeftHandle, bodyContent, docObserver);
+
+  RemoveListenerAndDeleteRef(mousedown, mMouseListenerP, PR_TRUE,
+                             mBottomLeftHandle, bodyContent, ps);
   mBottomLeftHandle = nsnull;
-  DeleteRefToAnonymousNode(mBottomHandle, bodyContent, docObserver);
+
+  RemoveListenerAndDeleteRef(mousedown, mMouseListenerP, PR_TRUE,
+                             mBottomHandle, bodyContent, ps);
   mBottomHandle = nsnull;
-  DeleteRefToAnonymousNode(mBottomRightHandle, bodyContent, docObserver);
+
+  RemoveListenerAndDeleteRef(mousedown, mMouseListenerP, PR_TRUE,
+                             mBottomRightHandle, bodyContent, ps);
   mBottomRightHandle = nsnull;
-  DeleteRefToAnonymousNode(mResizingShadow, bodyContent, docObserver);
+
+  RemoveListenerAndDeleteRef(mousedown, mMouseListenerP, PR_TRUE,
+                             mResizingShadow, bodyContent, ps);
   mResizingShadow = nsnull;
-  DeleteRefToAnonymousNode(mResizingInfo, bodyContent, docObserver);
+
+  RemoveListenerAndDeleteRef(mousedown, mMouseListenerP, PR_TRUE,
+                             mResizingInfo, bodyContent, ps);
   mResizingInfo = nsnull;
 
   // don't forget to remove the listeners !