Fix bug #3159040: make destruction order of browser_window objects sane

svn path=/trunk/netsurf/; revision=11345

1 files changed, 14 insertions, 6 deletions

diff --git a/desktop/browser.c b/desktop/browser.c
index f7202c040..073252b4a 100644
--- a/desktop/browser.c
+++ b/desktop/browser.c
@@ -989,6 +989,20 @@ void browser_window_destroy_internal(struct browser_window *bw)
 	if (bw->children != NULL || bw->iframes != NULL)
 		browser_window_destroy_children(bw);
 
+	schedule_remove(browser_window_refresh, bw);
+
+	/* Destruction order is important: we must ensure that the frontend 
+	 * destroys any window(s) associated with this browser window before 
+	 * we attempt any destructive cleanup. 
+	 *
+	 * Additionally, we must destroy any selection and history before
+	 * releasing the handle to any content objects this window is using.
+	 */
+
+	gui_window_destroy(bw->window);
+	selection_destroy(bw->sel);
+	history_destroy(bw->history);
+
 	if (bw->loading_content != NULL) {
 		hlcache_handle_release(bw->loading_content);
 		bw->loading_content = NULL;
@@ -1004,12 +1018,6 @@ void browser_window_destroy_internal(struct browser_window *bw)
 		bw->current_content = NULL;
 	}
 
-	schedule_remove(browser_window_refresh, bw);
-
-	selection_destroy(bw->sel);
-	history_destroy(bw->history);
-	gui_window_destroy(bw->window);
-
 	free(bw->name);
 	free(bw->frag_id);
 	free(bw->status_text);