nsFrameSelection is kept alive by Presshell (until Presshell is deleted) and for text form controls nsTextEditorState/nsTextControlFrame. When presshell is going away mShell is set to null using DisconnectFromPresShell. So, as long a mShell is there, the nsFrameSelection object should be certainly alive and the whole traversing is just useless.

Yes, the above comment is correct. I'm not familiar with the cycle collector or what NS_SUCCESS_INTERRUPTED_TRAVERSE means though, so you should get someone else to review the actual code change.

Comment on attachment 584818 [details] [diff] [review] patch Review of attachment 584818 [details] [diff] [review]: ----------------------------------------------------------------- Looks good. Death to death stars! r=me given mats's comment.

I started to worry about this a bit, so better be safe.

Comment on attachment 585860 [details] [diff] [review] Safer version Review of attachment 585860 [details] [diff] [review]: ----------------------------------------------------------------- The diff on top of the previous patch wasn't really necessary for a tiny patch. At some point, we should probably another CC macro for this pattern (if document is non-null and in the current generation, return interrupted traverse).