Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-12-27 19:09:47 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 330084: Don't crash when removing an node from the tree that noone holds on to. r/sr=jst

Browse Source
This commit is contained in:
cvshook%sicking.cc 2006-03-17 00:28:26 +00:00
parent dc3bae7389
commit 6c450d021d
2 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
content/base/src/nsGenericElement.cpp
View File

@ -2788,6 +2788,10 @@ nsGenericElement::doReplaceOrInsertBefore(PRBool aReplace,
return NS_ERROR_NULL_POINTER;
}
// Keep a strong reference to the node that we'll return to ensure it
// doesn't go away.
nsCOMPtr<nsIDOMNode> returnVal = aReplace ? aRefChild : aNewChild;
nsCOMPtr<nsIContent> refContent;
nsresult res = NS_OK;
PRInt32 insPos;
@ -3065,8 +3069,7 @@ nsGenericElement::doReplaceOrInsertBefore(PRBool aReplace,
NS_ENSURE_SUCCESS(res, res);
}
*aReturn = aReplace ? aRefChild : aNewChild;
NS_ADDREF(*aReturn);
returnVal.swap(*aReturn);
return res;
}

3
content/html/content/src/nsHTMLSelectElement.cpp
View File

@ -2285,7 +2285,8 @@ nsHTMLOptionCollection::SetOption(PRInt32 aIndex,
rv = mSelect->AppendChild(aOption, getter_AddRefs(ret));
} else {
// Find the option they're talking about and replace it
nsIDOMHTMLOptionElement *refChild = mElements.SafeObjectAt(aIndex);
// hold a strong reference to follow COM rules.
nsCOMPtr<nsIDOMHTMLOptionElement> refChild = mElements.SafeObjectAt(aIndex);
NS_ENSURE_TRUE(refChild, NS_ERROR_UNEXPECTED);
nsCOMPtr<nsIDOMNode> parent;