Bug 772282 - Hold on to nodes when we delete them in nsEditor::MoveNode; r=ehsan a=akeybl
authorEhsan Akhgari <ehsan@mozilla.com>
Fri, 13 Jul 2012 10:40:27 -0400
changeset 98420 ecda4431d2be287a1e432391803775da47a98994
parent 98419 9aa8643ad4bac0f371337b6f40fb5af556304b81
child 98421 156d908eccd4f9360c3918880864da4dbd424baf
push id1693
push usereakhgari@mozilla.com
push dateFri, 13 Jul 2012 14:40:34 +0000
treeherdermozilla-aurora@ecda4431d2be [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersehsan, akeybl
bugs772282
milestone15.0a2
Bug 772282 - Hold on to nodes when we delete them in nsEditor::MoveNode; r=ehsan a=akeybl
editor/libeditor/base/nsEditor.cpp
--- a/editor/libeditor/base/nsEditor.cpp
+++ b/editor/libeditor/base/nsEditor.cpp
@@ -1729,20 +1729,21 @@ nsEditor::MoveNode(nsIDOMNode *aNode, ns
   nsAutoMoveNodeSelNotify selNotify(mRangeUpdater, oldParent, oldOffset, aParent, aOffset);
   
   // need to adjust aOffset if we are moving aNode further along in its current parent
   if ((aParent == oldParent.get()) && (oldOffset < aOffset)) 
   {
     aOffset--;  // this is because when we delete aNode, it will make the offsets after it off by one
   }
 
-  // put aNode in new parent
-  res = DeleteNode(aNode);
+  // Hold a reference so aNode doesn't go away when we remove it (bug 772282)
+  nsCOMPtr<nsIDOMNode> node = aNode;
+  res = DeleteNode(node);
   NS_ENSURE_SUCCESS(res, res);
-  return InsertNode(aNode, aParent, aOffset);
+  return InsertNode(node, aParent, aOffset);
 }
 
 
 NS_IMETHODIMP
 nsEditor::AddEditorObserver(nsIEditorObserver *aObserver)
 {
   // we don't keep ownership of the observers.  They must
   // remove themselves as observers before they are destroyed.