Last Comment Bug 756757 - Use nsINode in nsHTMLEditor::MergeCells
: Use nsINode in nsHTMLEditor::MergeCells
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: Editor (show other bugs)
: Trunk
: All All
: -- normal (vote)
: mozilla16
Assigned To: :Ms2ger
:
Mentors:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2012-05-19 03:19 PDT by :Ms2ger
Modified: 2012-06-06 03:24 PDT (History)
1 user (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Patch v1 (5.24 KB, patch)
2012-05-19 03:19 PDT, :Ms2ger
ehsan: review+
Details | Diff | Review

Description :Ms2ger 2012-05-19 03:19:24 PDT
Created attachment 625390 [details] [diff] [review]
Patch v1
Comment 1 :Ehsan Akhgari (busy, don't ask for review please) 2012-05-22 10:57:03 PDT
Comment on attachment 625390 [details] [diff] [review]
Patch v1

Review of attachment 625390 [details] [diff] [review]:
-----------------------------------------------------------------

::: editor/libeditor/html/nsTableEditor.cpp
@@ +2380,5 @@
>      }
>  
>      // Move the contents
> +    while (cellToMerge->HasChildren()) {
> +      nsIDOMNode* cellChild = cellToMerge->GetLastChild()->AsDOMNode();

Hmm, this is a bit scary, since you're grabbing cellChild as a raw pointer, calling DeleteNode which _could_ destroy the object, and then you're passing it to InsertNode.  Please use an nsCOMPtr here.

Note You need to log in before you can comment on or make changes to this bug.