Fix Bug 708186. r=dholbert,jwatt a=dveditz
authorBrian Birtles <birtles@gmail.com>
Fri, 02 Mar 2012 10:52:58 +0900
changeset 35274 2b31786f3b3e9bce8050b91c7f4d8d9f98937e46
parent 35273 9b893007fa4ef23fb90301193122a9ed6ea55877
child 35275 c23ed8a949b2b27cb5df8a5621b8e60cef01a539
push id2029
push userbbirtles@mozilla.com
push dateFri, 02 Mar 2012 01:56:25 +0000
reviewersdholbert, jwatt, dveditz
bugs708186
milestone1.9.2.28pre
Fix Bug 708186. r=dholbert,jwatt a=dveditz
content/svg/content/src/nsSVGValue.cpp
--- a/content/svg/content/src/nsSVGValue.cpp
+++ b/content/svg/content/src/nsSVGValue.cpp
@@ -53,23 +53,23 @@ nsSVGValue::ReleaseObservers()
 {
   mObservers.Clear();
 }
 
 void
 nsSVGValue::NotifyObservers(SVGObserverNotifyFunction f,
                             modificationType aModType)
 {
-  PRInt32 count = mObservers.Length();
+  // Since notification can cause untold changes to the observers list, copy it
+  // first before iterating.
+  nsAutoTArray<nsWeakPtr, 1> observersCopy(mObservers);
+  PRInt32 count = observersCopy.Length();
 
-  // Since notification might cause the listeners to remove themselves
-  // from the observer list (mod_die), walk backwards through the list
-  // to catch everyone.
   for (PRInt32 i = count - 1; i >= 0; i--) {
-    nsIWeakReference* wr = mObservers.ElementAt(i);
+    nsIWeakReference* wr = observersCopy.ElementAt(i);
     nsCOMPtr<nsISVGValueObserver> observer = do_QueryReferent(wr);
     if (observer)
        (static_cast<nsISVGValueObserver*>(observer)->*f)(this, aModType);
   }
 }
 
 void
 nsSVGValue::WillModify(modificationType aModType)