http://mxr.mozilla.org/mozilla-central/source/layout/base/SelectionCarets.cpp?rev=8df7f01875e8#442 The FlushPendingNotifications call on line 465 might lead to Destroy() on mPresShell which calls Terminate on |this| and then nulls out its reference which might delete |this|. So we should proabably move this Flush to the start of the method and make sure all callers of UpdateSelectionCarets() holds a strong reference on the object they use for the call (and bail out if mPresShell is null after that call). We also need to make sure all callers of those methods deals with it, recursively. There is another Flush_Layout call here: http://mxr.mozilla.org/mozilla-central/source/layout/base/SelectionCarets.cpp?rev=8df7f01875e8#1074 We need to fix this in the same way. Also, callers of FlushPendingNotifications are required to hold a strong ref on the shell for the duration of the call, for example by holding a strong ref on the stack.
You need to log in before you can comment on or make changes to this bug.