From 8a516c2bc7130ecb8dd6641d66defc13eead3144 Mon Sep 17 00:00:00 2001
From: "bzbarsky%mit.edu" <bzbarsky%mit.edu>
Date: Wed, 2 Nov 2005 16:05:18 +0000
Subject: [PATCH] Make ReplaceObjectAt a little safer.  Bug 227780, r=timeless,
 sr=alecf

---
 xpcom/glue/nsCOMArray.cpp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/xpcom/glue/nsCOMArray.cpp b/xpcom/glue/nsCOMArray.cpp
index d66a729f041e..9a2702232ec3 100644
--- a/xpcom/glue/nsCOMArray.cpp
+++ b/xpcom/glue/nsCOMArray.cpp
@@ -115,8 +115,9 @@ nsCOMArray_base::ReplaceObjectAt(nsISupports* aObject, PRInt32 aIndex)
     // ReplaceElementAt could fail, such as if the array grows
     // so only release the existing object if the replacement succeeded
     if (result) {
-        NS_IF_RELEASE(oldObject);
+        // Make sure to addref first, in case aObject == oldObject
         NS_IF_ADDREF(aObject);
+        NS_IF_RELEASE(oldObject);
     }
     return result;
 }