Bug 395725, Crash [@ nsIFrame::GetFrameSelection], r+sr+a=roc
authorOlli.Pettay@helsinki.fi
Sat, 15 Sep 2007 12:48:20 -0700
changeset 5907 709bc82902e928c2fe336f9d4491fbeb9108eb2f
parent 5906 e80a6231ea8a849760275010fece548855cc3352
child 5908 c175700e53849201b86dc1a7b0c173ce393b744a
push id1
push userbsmedberg@mozilla.com
push dateThu, 20 Mar 2008 16:49:24 +0000
treeherdermozilla-central@61007906a1f8 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs395725
milestone1.9a8pre
Bug 395725, Crash [@ nsIFrame::GetFrameSelection], r+sr+a=roc
layout/generic/nsFrame.cpp
--- a/layout/generic/nsFrame.cpp
+++ b/layout/generic/nsFrame.cpp
@@ -2027,30 +2027,32 @@ nsFrame::PeekBackwardAndForward(nsSelect
 
   endNode = do_QueryInterface(endpos.mResultContent, &rv);
   if (NS_FAILED(rv))
     return rv;
   startNode = do_QueryInterface(startpos.mResultContent, &rv);
   if (NS_FAILED(rv))
     return rv;
 
+  // Keep frameSelection alive.
+  nsRefPtr<nsFrameSelection> frameSelection = GetFrameSelection();
   nsCOMPtr<nsISelection> selection;
   if (NS_SUCCEEDED(selcon->GetSelection(nsISelectionController::SELECTION_NORMAL,
                                         getter_AddRefs(selection)))){
     rv = selection->Collapse(startNode,startpos.mContentOffset);
     if (NS_FAILED(rv))
       return rv;
     rv = selection->Extend(endNode,endpos.mContentOffset);
     if (NS_FAILED(rv))
       return rv;
   }
   //no release 
 
   // maintain selection
-  return GetFrameSelection()->MaintainSelection(aAmountBack);
+  return frameSelection->MaintainSelection(aAmountBack);
 }
 
 // Figure out which view we should point capturing at, given that drag started
 // in this frame.
 static nsIView* GetNearestCapturingView(nsIFrame* aFrame) {
   nsIView* view = nsnull;
   while (!(view = aFrame->GetMouseCapturer()) && aFrame->GetParent()) {
     aFrame = aFrame->GetParent();