Bug 1383755 - Part 1. NAC property might be removed by nsIDocument::AdoptNode. r?masayuki draft
authorMakoto Kato <m_kato@ga2.so-net.ne.jp>
Mon, 31 Jul 2017 12:56:34 +0900
changeset 618262 12b40028f537b1542032d798769aa97e453198fd
parent 618186 6d1b50a370b4adffbb1ee73b9f51707c90d6a2b1
child 618263 e0297f065a5910fd75c09d5211cd9884fa03f4c1
push id71273
push userbmo:m_kato@ga2.so-net.ne.jp
push dateMon, 31 Jul 2017 04:13:15 +0000
reviewersmasayuki
bugs1383755
milestone56.0a1
Bug 1383755 - Part 1. NAC property might be removed by nsIDocument::AdoptNode. r?masayuki nsIDocument::AdoptNode might to remove all properties. So before destroying editor, NAC property might be already removed. So we have to consider that NAC is removed. MozReview-Commit-ID: DakRRqrzEtF
editor/libeditor/HTMLAnonymousNodeEditor.cpp
--- a/editor/libeditor/HTMLAnonymousNodeEditor.cpp
+++ b/editor/libeditor/HTMLAnonymousNodeEditor.cpp
@@ -322,20 +322,23 @@ HTMLEditor::DeleteRefToAnonymousNode(nsI
         docObserver->EndUpdate(document, UPDATE_CONTENT_MODEL);
       }
     }
   }
 
   // Remove reference from the parent element.
   auto nac = static_cast<mozilla::ManualNAC*>(
       parentContent->GetProperty(nsGkAtoms::manualNACProperty));
-  MOZ_ASSERT(nac);
-  nac->RemoveElement(aContent);
-  if (nac->IsEmpty()) {
-    parentContent->DeleteProperty(nsGkAtoms::manualNACProperty);
+  // nsIDocument::AdoptNode might remove all properties before destroying
+  // editor.  So we have to consider that NAC could be already removed.
+  if (nac) {
+    nac->RemoveElement(aContent);
+    if (nac->IsEmpty()) {
+      parentContent->DeleteProperty(nsGkAtoms::manualNACProperty);
+    }
   }
 
   aContent->UnbindFromTree();
 }
 
 // The following method is mostly called by a selection listener. When a
 // selection change is notified, the method is called to check if resizing
 // handles, a grabber and/or inline table editing UI need to be displayed