Bug 677847 - Crash [@ nsContentUtils::IsEventAttributeName ], r=jst
authorOlli Pettay <Olli.Pettay@helsinki.fi>
Wed, 10 Aug 2011 23:24:48 +0300
changeset 74189 52c4a8829da3fa4452fba03ffc3e8233988324dd
parent 74188 e44dad2d2745de578830cc3b326c821aa3f7407c
child 74190 3bf55a9e34e8f6e86372c19b4881da49a88cd5bc
push id2
push userbsmedberg@mozilla.com
push dateFri, 19 Aug 2011 14:38:13 +0000
reviewersjst
bugs677847
milestone8.0a1
Bug 677847 - Crash [@ nsContentUtils::IsEventAttributeName ], r=jst
content/base/src/nsTreeSanitizer.cpp
--- a/content/base/src/nsTreeSanitizer.cpp
+++ b/content/base/src/nsTreeSanitizer.cpp
@@ -1190,17 +1190,17 @@ nsTreeSanitizer::SanitizeAttributes(mozi
   PRUint32 ac = aElement->GetAttrCount();
 
   nsresult rv;
 
   for (PRInt32 i = ac - 1; i >= 0; --i) {
     rv = NS_OK;
     const nsAttrName* attrName = aElement->GetAttrNameAt(i);
     PRInt32 attrNs = attrName->NamespaceID();
-    nsIAtom* attrLocal = attrName->LocalName();
+    nsCOMPtr<nsIAtom> attrLocal = attrName->LocalName();
 
     if (kNameSpaceID_None == attrNs) {
       if (aAllowStyle && nsGkAtoms::style == attrLocal) {
         nsCOMPtr<nsIURI> baseURI = aElement->GetBaseURI();
         nsIDocument* document = aElement->GetOwnerDoc();
         // Pass the CSS Loader object to the parser, to allow parser error
         // reports to include the outer window ID.
         nsCSSParser parser(document->CSSLoader());