Bug 1383755 - Part 1. NAC property might be removed by nsIDocument::AdoptNode. r=masayuki
authorMakoto Kato <m_kato@ga2.so-net.ne.jp>
Mon, 31 Jul 2017 12:56:34 +0900
changeset 420651 1b4c1019f2abca90bcc9e310998f3c12c4de8a7c
parent 420650 42d64afd61ab3804625db4768fdd437aead6b4db
child 420652 9aa80b8b5650361cf25c08050309e5f0e0da7da8
push id7566
push usermtabara@mozilla.com
push dateWed, 02 Aug 2017 08:25:16 +0000
treeherdermozilla-beta@86913f512c3c [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersmasayuki
bugs1383755
milestone56.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1383755 - Part 1. NAC property might be removed by nsIDocument::AdoptNode. r=masayuki nsIDocument::AdoptNode might to remove all properties. So before destroying editor, NAC property might be already removed. So we have to consider that NAC is removed. MozReview-Commit-ID: DakRRqrzEtF
editor/libeditor/HTMLAnonymousNodeEditor.cpp
--- a/editor/libeditor/HTMLAnonymousNodeEditor.cpp
+++ b/editor/libeditor/HTMLAnonymousNodeEditor.cpp
@@ -322,20 +322,23 @@ HTMLEditor::DeleteRefToAnonymousNode(nsI
         docObserver->EndUpdate(document, UPDATE_CONTENT_MODEL);
       }
     }
   }
 
   // Remove reference from the parent element.
   auto nac = static_cast<mozilla::ManualNAC*>(
       parentContent->GetProperty(nsGkAtoms::manualNACProperty));
-  MOZ_ASSERT(nac);
-  nac->RemoveElement(aContent);
-  if (nac->IsEmpty()) {
-    parentContent->DeleteProperty(nsGkAtoms::manualNACProperty);
+  // nsIDocument::AdoptNode might remove all properties before destroying
+  // editor.  So we have to consider that NAC could be already removed.
+  if (nac) {
+    nac->RemoveElement(aContent);
+    if (nac->IsEmpty()) {
+      parentContent->DeleteProperty(nsGkAtoms::manualNACProperty);
+    }
   }
 
   aContent->UnbindFromTree();
 }
 
 // The following method is mostly called by a selection listener. When a
 // selection change is notified, the method is called to check if resizing
 // handles, a grabber and/or inline table editing UI need to be displayed