Bug 1383755 - Part 1. NAC property might be removed by nsIDocument::AdoptNode. r?masayuki
nsIDocument::AdoptNode might to remove all properties. So before destroying editor, NAC property might be already removed. So we have to consider that NAC is removed.
MozReview-Commit-ID: DakRRqrzEtF
--- a/editor/libeditor/HTMLAnonymousNodeEditor.cpp
+++ b/editor/libeditor/HTMLAnonymousNodeEditor.cpp
@@ -322,20 +322,23 @@ HTMLEditor::DeleteRefToAnonymousNode(nsI
docObserver->EndUpdate(document, UPDATE_CONTENT_MODEL);
}
}
}
// Remove reference from the parent element.
auto nac = static_cast<mozilla::ManualNAC*>(
parentContent->GetProperty(nsGkAtoms::manualNACProperty));
- MOZ_ASSERT(nac);
- nac->RemoveElement(aContent);
- if (nac->IsEmpty()) {
- parentContent->DeleteProperty(nsGkAtoms::manualNACProperty);
+ // nsIDocument::AdoptNode might remove all properties before destroying
+ // editor. So we have to consider that NAC could be already removed.
+ if (nac) {
+ nac->RemoveElement(aContent);
+ if (nac->IsEmpty()) {
+ parentContent->DeleteProperty(nsGkAtoms::manualNACProperty);
+ }
}
aContent->UnbindFromTree();
}
// The following method is mostly called by a selection listener. When a
// selection change is notified, the method is called to check if resizing
// handles, a grabber and/or inline table editing UI need to be displayed