Bug 336978, Crash when window gets destroyed on pagehide event, r+sr=bryner

docshell/base/nsDocShell.cpp

@@ -921,6 +921,9 @@ NS_IMETHODIMP
 nsDocShell::FirePageHideNotification(PRBool aIsUnload)
 {
     if (mContentViewer && !mFiredUnloadEvent) {
+        // Keep an explicit reference since calling PageHide could release
+        // mContentViewer
+        nsCOMPtr<nsIContentViewer> kungFuDeathGrip(mContentViewer);
         mFiredUnloadEvent = PR_TRUE;
 
         mContentViewer->PageHide(aIsUnload);