---

yaml
---
r: 167481
b: refs/heads/master
c: e09105f
h: refs/heads/master
i:
  167479: 2ca6568
v: v3

[refs]

@@ -1,2 +1,2 @@
 ---
-refs/heads/master: dc2469abccaae7bf68098978300c7d489f1e8f4f
+refs/heads/master: e09105ffab9281a2d83b5341f6dfa7e61aad47b8

trunk/widget/src/gtk2/nsWindow.cpp

@@ -4824,25 +4824,52 @@ nsChildWindow::~nsChildWindow()
 
 #ifdef USE_XIM
 
+void
+nsWindow::IMEInitData(void)
+{
+    NS_ASSERTION(!mIMEData, "This window was already initialized.");
+    nsWindow *win = IMEGetOwningWindow();
+    if (!win)
+        return;
+    mIMEData = win->mIMEData;
+    if (!mIMEData)
+        return;
+    mIMEData->mRefCount++;
+}
+
+void
+nsWindow::IMEReleaseData(void)
+{
+    if (!mIMEData)
+        return;
+
+    mIMEData->mRefCount--;
+    if (mIMEData->mRefCount != 0)
+        return;
+
+    delete mIMEData;
+    mIMEData = nsnull;
+}
+
 void
 nsWindow::IMEDestroyContext(void)
 {
     if (!mIMEData || mIMEData->mOwner != this) {
-        // This nsWindow is not the owner of the instance of mIMEData,
-        // we should only clear reference to this.
+        // This nsWindow is not the owner of the instance of mIMEData.
         if (IMEComposingWindow() == this)
             CancelIMEComposition();
         if (gIMEFocusWindow == this)
             gIMEFocusWindow = nsnull;
+        IMEReleaseData();
         return;
     }
 
     /* NOTE:
      * This nsWindow is the owner of the instance of mIMEData,
-     * so, we must free the instance now. But that was referred from other
-     * nsWindows.(They are children of this.) But we don't need to worry about
-     * this issue. Because this function is only called on destroying this
-     * nsWindow. So, the children of this window should already be destroyed.
+     * so, we must release the contexts now. But that might be referred from
+     * other nsWindows.(They are children of this. But we don't know why there
+     * are the cases.) So, we need to clear the pointers that refers to contexts
+     * and this if the other referrers are still alive. See bug 349727.
      */
 
     // If this is the focus window and we have an IM context we need
@@ -4853,29 +4880,30 @@ nsWindow::IMEDestroyContext(void)
         gIMEFocusWindow = nsnull;
     }
 
+    mIMEData->mOwner   = nsnull;
+    mIMEData->mEnabled = PR_FALSE;
+
     if (mIMEData->mContext) {
         gtk_im_context_set_client_window(mIMEData->mContext, nsnull);
         g_object_unref(G_OBJECT(mIMEData->mContext));
+        mIMEData->mContext = nsnull;
     }
 
     if (mIMEData->mDummyContext) {
         gtk_im_context_set_client_window(mIMEData->mDummyContext, nsnull);
         g_object_unref(G_OBJECT(mIMEData->mDummyContext));
+        mIMEData->mDummyContext = nsnull;
     }
 
-    delete mIMEData;
-    mIMEData = nsnull;
+    IMEReleaseData();
 }
 
 void
 nsWindow::IMESetFocus(void)
 {
     // Initialize mIMEData for this window
-    if (!mIMEData) {
-      nsWindow *win = IMEGetOwningWindow();
-      if (win)
-        mIMEData = win->mIMEData;
-    }
+    if (!mIMEData)
+        IMEInitData();
 
     LOGIM(("IMESetFocus %p\n", (void *)this));
     GtkIMContext *im = IMEGetContext();

trunk/widget/src/gtk2/nsWindow.h

@@ -268,6 +268,8 @@ class nsWindow : public nsCommonWidget, public nsSupportsWeakReference
     static guint32     mLastButtonReleaseTime;
 
 #ifdef USE_XIM
+    void               IMEInitData       (void);
+    void               IMEReleaseData    (void);
     void               IMEDestroyContext (void);
     void               IMESetFocus       (void);
     void               IMELoseFocus      (void);
@@ -309,15 +311,19 @@ class nsWindow : public nsCommonWidget, public nsSupportsWeakReference
         // mComposingWindow to commit or reset the composition.
         nsWindow           *mComposingWindow;
         // Owner of this struct.
-        // The owner window must free this instance at destroying.
+        // The owner window must release the contexts at destroying.
         nsWindow           *mOwner;
+        // The reference counter. When this will be zero by the decrement,
+        // the decrementer must free the instance.
+        PRUint32           mRefCount;
         // IME enabled state in this window.
         PRPackedBool       mEnabled;
         nsIMEData(nsWindow* aOwner) {
             mContext         = nsnull;
             mDummyContext    = nsnull;
             mComposingWindow = nsnull;
             mOwner           = aOwner;
+            mRefCount        = 1;
             mEnabled         = PR_TRUE;
         }
     };