From 8eff14968e63bbb3320e8e20d2061288fc00ab6b Mon Sep 17 00:00:00 2001
From: "masayuki%d-toybox.com"
 <masayuki%d-toybox.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Tue, 23 Feb 2010 18:01:07 +0000
Subject: [PATCH] Bug 537828 crash [@
 nsAString_internal::Assign(nsAString_internal const&)] r=smaug,
 a19019=beltzner

git-svn-id: svn://10.0.0.236/trunk@259797 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/editor/libeditor/base/nsEditor.cpp | 15 +++++++++------
 mozilla/editor/libeditor/base/nsEditor.h   |  7 ++++---
 2 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/mozilla/editor/libeditor/base/nsEditor.cpp b/mozilla/editor/libeditor/base/nsEditor.cpp
index 5eaa2eb5772..403cc6f27bb 100644
--- a/mozilla/editor/libeditor/base/nsEditor.cpp
+++ b/mozilla/editor/libeditor/base/nsEditor.cpp
@@ -2584,15 +2584,17 @@ NS_IMETHODIMP nsEditor::InsertTextImpl(const nsAString& aStringToInsert,
 }
 
 
-NS_IMETHODIMP nsEditor::InsertTextIntoTextNodeImpl(const nsAString& aStringToInsert, 
-                                                     nsIDOMCharacterData *aTextNode, 
-                                                     PRInt32 aOffset, PRBool suppressIME)
+nsresult nsEditor::InsertTextIntoTextNodeImpl(const nsAString& aStringToInsert, 
+                                              nsIDOMCharacterData *aTextNode, 
+                                              PRInt32 aOffset,
+                                              PRBool aSuppressIME)
 {
   nsRefPtr<EditTxn> txn;
   nsresult result;
-  // suppressIME s used when editor must insert text, yet this text is not
+  PRBool isIMETransaction = PR_FALSE;
+  // aSuppressIME is used when editor must insert text, yet this text is not
   // part of current ime operation.  example: adjusting whitespace around an ime insertion.
-  if (mIMETextRangeList && mInIMEMode && !suppressIME)
+  if (mIMETextRangeList && mInIMEMode && !aSuppressIME)
   {
     if (!mIMETextNode)
     {
@@ -2640,6 +2642,7 @@ NS_IMETHODIMP nsEditor::InsertTextIntoTextNodeImpl(const nsAString& aStringToIns
     nsRefPtr<IMETextTxn> imeTxn;
     result = CreateTxnForIMEText(aStringToInsert, getter_AddRefs(imeTxn));
     txn = imeTxn;
+    isIMETransaction = PR_TRUE;
   }
   else
   {
@@ -2676,7 +2679,7 @@ NS_IMETHODIMP nsEditor::InsertTextIntoTextNodeImpl(const nsAString& aStringToIns
   // savvy to having multiple ime txns inside them.
   
   // delete empty ime text node if there is one
-  if (mInIMEMode && mIMETextNode)
+  if (isIMETransaction)
   {
     PRUint32 len;
     mIMETextNode->GetLength(&len);
diff --git a/mozilla/editor/libeditor/base/nsEditor.h b/mozilla/editor/libeditor/base/nsEditor.h
index 26f474f95bd..bd3d27ad5dc 100644
--- a/mozilla/editor/libeditor/base/nsEditor.h
+++ b/mozilla/editor/libeditor/base/nsEditor.h
@@ -164,9 +164,10 @@ public:
                                nsCOMPtr<nsIDOMNode> *aInOutNode, 
                                PRInt32 *aInOutOffset,
                                nsIDOMDocument *aDoc);
-  NS_IMETHOD InsertTextIntoTextNodeImpl(const nsAString& aStringToInsert, 
-                                           nsIDOMCharacterData *aTextNode, 
-                                           PRInt32 aOffset, PRBool suppressIME=PR_FALSE);
+  nsresult InsertTextIntoTextNodeImpl(const nsAString& aStringToInsert, 
+                                      nsIDOMCharacterData *aTextNode, 
+                                      PRInt32 aOffset,
+                                      PRBool aSuppressIME = PR_FALSE);
   NS_IMETHOD DeleteSelectionImpl(EDirection aAction);
   NS_IMETHOD DeleteSelectionAndCreateNode(const nsAString& aTag,
                                            nsIDOMNode ** aNewNode);