Use nsINode in nsHTMLEditor::MergeCells

RESOLVED FIXED in mozilla16

Status

()

Core
Editor
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: Ms2ger, Assigned: Ms2ger)

Tracking

Trunk
mozilla16
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Assignee)

Description

5 years ago
Created attachment 625390 [details] [diff] [review]
Patch v1
Attachment #625390 - Flags: review?(ehsan)
Comment on attachment 625390 [details] [diff] [review]
Patch v1

Review of attachment 625390 [details] [diff] [review]:
-----------------------------------------------------------------

::: editor/libeditor/html/nsTableEditor.cpp
@@ +2380,5 @@
>      }
>  
>      // Move the contents
> +    while (cellToMerge->HasChildren()) {
> +      nsIDOMNode* cellChild = cellToMerge->GetLastChild()->AsDOMNode();

Hmm, this is a bit scary, since you're grabbing cellChild as a raw pointer, calling DeleteNode which _could_ destroy the object, and then you're passing it to InsertNode.  Please use an nsCOMPtr here.
Attachment #625390 - Flags: review?(ehsan) → review+
(Assignee)

Comment 2

5 years ago
https://hg.mozilla.org/mozilla-central/rev/9a208c9ceb72
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla16
You need to log in before you can comment on or make changes to this bug.