Bug 330084: Don't crash when removing an node from the tree that noone holds on to. r/sr=jst

2006-03-17 00:28:26 +00:00
parent 0c9e9988d7
commit 9538e62fc5
2 changed files with 7 additions and 3 deletions
--- a/content/base/src/nsGenericElement.cpp
+++ b/content/base/src/nsGenericElement.cpp
@@ -2788,6 +2788,10 @@ nsGenericElement::doReplaceOrInsertBefore(PRBool aReplace,
    return NS_ERROR_NULL_POINTER;
  }

+  // Keep a strong reference to the node that we'll return to ensure it
+  // doesn't go away.
+  nsCOMPtr<nsIDOMNode> returnVal = aReplace ? aRefChild : aNewChild;
+
  nsCOMPtr<nsIContent> refContent;
  nsresult res = NS_OK;
  PRInt32 insPos;
@@ -3065,8 +3069,7 @@ nsGenericElement::doReplaceOrInsertBefore(PRBool aReplace,
    NS_ENSURE_SUCCESS(res, res);
  }

-  *aReturn = aReplace ? aRefChild : aNewChild;
-  NS_ADDREF(*aReturn);
+  returnVal.swap(*aReturn);

  return res;
 }