From 117932d74b252cd01991b45d4f086ffbfba98d78 Mon Sep 17 00:00:00 2001
From: "kin%netscape.com" <kin%netscape.com>
Date: Wed, 9 Apr 2003 21:10:58 +0000
Subject: [PATCH] Fix for bug 199490: A crash occurs after clicking in (HTML
 tags )document - Trunk [@

nsHTMLEditor::SetFinalSize]

  - A one line fix in HideResizers() which prevents the
    reported crash by setting mIsResizing to false. I assume
    we can't be resizing if the resize handles are being hidden.
    The assertion and null check in SetFinalSize() are just because
    I'm paranoid, but they should never be triggered if HideResizers()
    is called first.

  - The changes in StartResizing() makes it so that we don't create
    a new mouse motion listener if we already have one. We were
    creating a new listener each time we clicked on the handles, and
    never unregistering the old one ... this meant that the old
    listeners could be triggered if the editor were ever destroyed
    and the document left in tact ... allowing us to crash because the
    listeners keep an un-addref'd pointer to the HTMLEditor. Note that
    this crash is not likely to be hit in Mozilla since we always
    destroy the document and editor in Composer and MailCompose, but
    it can happen in an embedding context.

r=glazman@netscape.com  sr=sfraser@netscape.com
---
 editor/libeditor/html/nsHTMLObjectResizer.cpp | 30 ++++++++++++-------
 1 file changed, 20 insertions(+), 10 deletions(-)

diff --git a/editor/libeditor/html/nsHTMLObjectResizer.cpp b/editor/libeditor/html/nsHTMLObjectResizer.cpp
index 88be0770fb66..bd0809f7f1c0 100644
--- a/editor/libeditor/html/nsHTMLObjectResizer.cpp
+++ b/editor/libeditor/html/nsHTMLObjectResizer.cpp
@@ -549,6 +549,7 @@ nsHTMLEditor::HideResizers(void)
 
   mIsShowingResizeHandles = PR_FALSE;
   mResizedObject = nsnull;
+  mIsResizing = PR_FALSE;
 
   return NS_OK;
 }
@@ -604,19 +605,25 @@ nsHTMLEditor::StartResizing(nsIDOMElement *aHandle)
                                 h + NS_LITERAL_STRING("px"),
                                 PR_TRUE);
 
-  // add a mouse move listener to the editor
-  mMouseMotionListenerP = new ResizerMouseMotionListener(this);
-  if (!mMouseMotionListenerP) {return NS_ERROR_NULL_POINTER;}
+  nsresult result = NS_OK;
 
-  nsCOMPtr<nsIDOMEventReceiver> erP;
-  nsresult result = GetDOMEventReceiver(getter_AddRefs(erP));
-  if (NS_SUCCEEDED(result) && erP)
+  if (!mMouseMotionListenerP)
   {
-    result = erP->AddEventListener(NS_LITERAL_STRING("mousemove"), mMouseMotionListenerP, PR_TRUE);
-    NS_ASSERTION(NS_SUCCEEDED(result), "failed to register mouse motion listener");
+    // add a mouse move listener to the editor
+    mMouseMotionListenerP = new ResizerMouseMotionListener(this);
+    if (!mMouseMotionListenerP) {return NS_ERROR_NULL_POINTER;}
+
+    nsCOMPtr<nsIDOMEventReceiver> erP;
+    result = GetDOMEventReceiver(getter_AddRefs(erP));
+    if (NS_SUCCEEDED(result) && erP)
+    {
+      result = erP->AddEventListener(NS_LITERAL_STRING("mousemove"), mMouseMotionListenerP, PR_TRUE);
+      NS_ASSERTION(NS_SUCCEEDED(result), "failed to register mouse motion listener");
+    }
+    else
+      HandleEventListenerError();
   }
-  else
-    HandleEventListenerError();
+
   return result;
 }
 
@@ -879,6 +886,9 @@ nsHTMLEditor::MouseMove(nsIDOMEvent* aMouseEvent)
 void
 nsHTMLEditor::SetFinalSize(PRInt32 aX, PRInt32 aY)
 {
+  NS_ASSERTION(mResizedObject, "SetFinalSize() called with null mResizedObject ptr!");
+  if (!mResizedObject) return;
+
   // we have now to set the new width and height of the resized object
   // we don't set the x and y position because we don't control that in
   // a normal HTML layout