Bug 433758, Crash [@ nsContentList::Item], r+sr=jst
authorOlli Pettay <Olli.Pettay@helsinki.fi>
Wed, 04 Jun 2008 23:18:58 +0300
changeset 15253 75271d55db392bfff62e9d2ed0dacd3a7b1a1176
parent 15252 64d4930792c5c0bea51648298f77cd54e24754ae
child 15254 b415442740dbb3119be708929c8e9d3c599650c7
push id82
push useropettay@mozilla.com
push dateWed, 04 Jun 2008 20:19:35 +0000
treeherdermozilla-central@75271d55db39 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs433758
milestone1.9.1a1pre
Bug 433758, Crash [@ nsContentList::Item], r+sr=jst
content/html/document/src/nsHTMLDocument.cpp
--- a/content/html/document/src/nsHTMLDocument.cpp
+++ b/content/html/document/src/nsHTMLDocument.cpp
@@ -3872,29 +3872,31 @@ nsHTMLDocument::GetDocumentAllResult(con
   }
 
   if (!entry->mDocAllList) {
     entry->mDocAllList = new nsContentList(root, DocAllResultMatch,
                                            nsnull, nsnull, PR_TRUE, id);
     NS_ENSURE_TRUE(entry->mDocAllList, NS_ERROR_OUT_OF_MEMORY);
   }
 
+  nsRefPtr<nsContentList> docAllList = entry->mDocAllList;
+
   // Check if there are more than 1 entries. Do this by getting the second one
   // rather than the length since getting the length always requires walking
   // the entire document.
 
-  nsIContent* cont = entry->mDocAllList->Item(1, PR_TRUE);
+  nsIContent* cont = docAllList->Item(1, PR_TRUE);
   if (cont) {
-    NS_ADDREF(*aResult = static_cast<nsIDOMNodeList*>(entry->mDocAllList));
+    NS_ADDREF(*aResult = static_cast<nsIDOMNodeList*>(docAllList));
 
     return NS_OK;
   }
 
   // There's only 0 or 1 items. Return the first one or null.
-  NS_IF_ADDREF(*aResult = entry->mDocAllList->Item(0, PR_TRUE));
+  NS_IF_ADDREF(*aResult = docAllList->Item(0, PR_TRUE));
 
   return NS_OK;
 }
 
 static void
 NotifyEditableStateChange(nsINode *aNode, nsIDocument *aDocument,
                           PRBool aEditable)
 {