112430 - nsGfxTextControlFrameState2::Destroy() should not trigger calls into the editor

Status: VERIFIED FIXED

(Core :: DOM: Editor, defect)

Description

[kinmoz]

This bug was split off from crasher bug 109754, which was fixed with a simple
null check, but the cause is still present ...

The basic problem is that the rev 1.170 checkin to nsGfxTextControlFrame2.cpp by
jst/jkeiser, modified the Destroy() method to call GetTextControlFrameState(),
which uses the editor.

We shouldn't be doing that since at the time Destroy() is called, there are no
guarantees that some of the things the editor relies on, for example style
contexts, content, etc., are going to be around.

We need to find some other place to retrieve the value of the editor, before
Destroy() is called. Perhaps the frame manager has a notification we can hook into?

Comment 1

[John Keiser (jkeiser)]

Setting milestone to 1.0 because of bug 74091.

Comment 2

[Kevin McCluskey (gone)]

Moving to Moz1.1

Comment 3

[John Keiser (jkeiser)]

This was fixed in bug 132334.

Comment 4

[sujay]

code level fix; need help from development to verify. Charley/Kathy, can you
please verify these and mark verified-fixed ? thanks.

Comment 5

[sujay]

verified....