From a22cce94f55906dd124171d816711685d247b76c Mon Sep 17 00:00:00 2001 From: "peterv%propagandism.org" Date: Tue, 14 Jun 2005 12:30:17 +0000 Subject: [PATCH] Fix for bug 297311 (consistent crash when trying to call xmlDocument.replaceChild(newChild, xmlDocument.documentElement) on XML document rendered in a frame). r/sr=bz, a=asa. git-svn-id: svn://10.0.0.236/trunk@174560 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/content/xbl/src/nsBindingManager.cpp | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/mozilla/content/xbl/src/nsBindingManager.cpp b/mozilla/content/xbl/src/nsBindingManager.cpp index c86f4173dcb..8eb0d9ca037 100644 --- a/mozilla/content/xbl/src/nsBindingManager.cpp +++ b/mozilla/content/xbl/src/nsBindingManager.cpp @@ -415,7 +415,9 @@ nsBindingManager::ChangeDocumentFor(nsIContent* aContent, nsIDocument* aOldDocum if (! aOldDocument) return NS_ERROR_NULL_POINTER; - nsXBLBinding *binding = nsBindingManager::GetBinding(aContent); + // Hold a ref to the binding so it won't die when we remove it from our + // table. + nsRefPtr binding = nsBindingManager::GetBinding(aContent); if (binding) { binding->ChangeDocument(aOldDocument, aNewDocument); SetBinding(aContent, nsnull);