From a9d7255ba18f49ab00d9932d24add35fa641a1e7 Mon Sep 17 00:00:00 2001
From: Martok <martok@martoks-place.de>
Date: Sun, 14 Jan 2024 21:55:06 +0100
Subject: [PATCH] Issue #2452 - Bail out from PresShell::Initialize if the pres
 shell is being destroyed in XBLConstructorRunner

https://bugzilla.mozilla.org/show_bug.cgi?id=1428694
---
 layout/base/nsPresShell.cpp | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/layout/base/nsPresShell.cpp b/layout/base/nsPresShell.cpp
index 14c8e9e906..460949e0fe 100644
--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@@ -1771,6 +1771,9 @@ PresShell::Initialize(nscoord aWidth, nscoord aHeight)
     // (Do this in a script runner, since our caller might have a script
     // blocker on the stack.)
     nsContentUtils::AddScriptRunner(new XBLConstructorRunner(mDocument));
+
+    // XBLConstructorRunner might destroy us.
+    NS_ENSURE_STATE(!mHaveShutDown);
   }
 
   NS_ASSERTION(rootFrame, "How did that happen?");