Bug 1641752. Don't access dead frame in AutoScrollbarRepaintSuppression. r=kats

Differential Revision: https://phabricator.services.mozilla.com/D77403

layout/generic/nsGfxScrollFrame.cpp

@@ -2991,8 +2991,9 @@ void ScrollFrameHelper::ScrollToImpl(nsPoint aPt, const nsRect& aRange,
   PresShell::AutoAssertNoFlush noFlush(*mOuter->PresShell());
 
   {  // scope the AutoScrollbarRepaintSuppression
-    AutoScrollbarRepaintSuppression repaintSuppression(this, !schedulePaint);
     AutoWeakFrame weakFrame(mOuter);
+    AutoScrollbarRepaintSuppression repaintSuppression(this, weakFrame,
+                                                       !schedulePaint);
     UpdateScrollbarPosition();
     if (!weakFrame.IsAlive()) {
       return;

layout/generic/nsGfxScrollFrame.h

@@ -700,18 +700,23 @@ class ScrollFrameHelper : public nsIReflowCallback {
   friend class AutoScrollbarRepaintSuppression;
   class AutoScrollbarRepaintSuppression {
    public:
-    AutoScrollbarRepaintSuppression(ScrollFrameHelper* aHelper, bool aSuppress)
+    AutoScrollbarRepaintSuppression(ScrollFrameHelper* aHelper,
+                                    AutoWeakFrame& aWeakOuter, bool aSuppress)
         : mHelper(aHelper),
+          mWeakOuter(aWeakOuter),
           mOldSuppressValue(aHelper->mSuppressScrollbarRepaints) {
       mHelper->mSuppressScrollbarRepaints = aSuppress;
     }
 
     ~AutoScrollbarRepaintSuppression() {
-      mHelper->mSuppressScrollbarRepaints = mOldSuppressValue;
+      if (mWeakOuter.IsAlive()) {
+        mHelper->mSuppressScrollbarRepaints = mOldSuppressValue;
+      }
     }
 
    private:
     ScrollFrameHelper* mHelper;
+    AutoWeakFrame& mWeakOuter;
     bool mOldSuppressValue;
   };