From 71fae75ff61c389eaf52ff0e98b7b970e97f2094 Mon Sep 17 00:00:00 2001
From: "joki%netscape.com" <joki%netscape.com>
Date: Tue, 8 Jun 1999 19:01:56 +0000
Subject: [PATCH] Fix hover state crash at document change.  Bug 6580

---
 content/events/src/nsEventStateManager.cpp | 16 +++++++++++++---
 layout/events/src/nsEventStateManager.cpp  | 16 +++++++++++++---
 2 files changed, 26 insertions(+), 6 deletions(-)

diff --git a/content/events/src/nsEventStateManager.cpp b/content/events/src/nsEventStateManager.cpp
index 3f26c1c5d2b3..6df676c6272e 100644
--- a/content/events/src/nsEventStateManager.cpp
+++ b/content/events/src/nsEventStateManager.cpp
@@ -942,14 +942,24 @@ nsEventStateManager::SetContentState(nsIContent *aContent, PRInt32 aState)
 
   // remove duplicates
   if ((notifyContent[4] == notifyContent[3]) || (notifyContent[4] == notifyContent[2]) || (notifyContent[4] == notifyContent[1])) {
-    notifyContent[4] = nsnull;
+    NS_IF_RELEASE(notifyContent[4]);
   }
   // remove duplicates
   if ((notifyContent[3] == notifyContent[2]) || (notifyContent[3] == notifyContent[1])) {
-    notifyContent[3] = nsnull;
+    NS_IF_RELEASE(notifyContent[3]);
   }
   if (notifyContent[2] == notifyContent[1]) {
-    notifyContent[2] = nsnull;
+    NS_IF_RELEASE(notifyContent[2]);
+  }
+
+  // remove notifications for content not in document.
+  // we may decide this is possible later but right now it has problems.
+  nsIDocument* doc = nsnull;
+  for  (int i = 0; i < maxNotify; i++) {
+    if (notifyContent[i] && NS_SUCCEEDED(notifyContent[i]->GetDocument(doc)) && !doc) {
+      NS_RELEASE(notifyContent[i]);
+    }
+    NS_IF_RELEASE(doc);
   }
 
   // compress the notify array to group notifications tighter
diff --git a/layout/events/src/nsEventStateManager.cpp b/layout/events/src/nsEventStateManager.cpp
index 3f26c1c5d2b3..6df676c6272e 100644
--- a/layout/events/src/nsEventStateManager.cpp
+++ b/layout/events/src/nsEventStateManager.cpp
@@ -942,14 +942,24 @@ nsEventStateManager::SetContentState(nsIContent *aContent, PRInt32 aState)
 
   // remove duplicates
   if ((notifyContent[4] == notifyContent[3]) || (notifyContent[4] == notifyContent[2]) || (notifyContent[4] == notifyContent[1])) {
-    notifyContent[4] = nsnull;
+    NS_IF_RELEASE(notifyContent[4]);
   }
   // remove duplicates
   if ((notifyContent[3] == notifyContent[2]) || (notifyContent[3] == notifyContent[1])) {
-    notifyContent[3] = nsnull;
+    NS_IF_RELEASE(notifyContent[3]);
   }
   if (notifyContent[2] == notifyContent[1]) {
-    notifyContent[2] = nsnull;
+    NS_IF_RELEASE(notifyContent[2]);
+  }
+
+  // remove notifications for content not in document.
+  // we may decide this is possible later but right now it has problems.
+  nsIDocument* doc = nsnull;
+  for  (int i = 0; i < maxNotify; i++) {
+    if (notifyContent[i] && NS_SUCCEEDED(notifyContent[i]->GetDocument(doc)) && !doc) {
+      NS_RELEASE(notifyContent[i]);
+    }
+    NS_IF_RELEASE(doc);
   }
 
   // compress the notify array to group notifications tighter