From d615bdff683292a63231f9268ab5a7cb75bf461f Mon Sep 17 00:00:00 2001 From: "bzbarsky%mit.edu" Date: Mon, 5 Jan 2004 23:43:28 +0000 Subject: [PATCH] Make ReplaceObjectAt a little safer. Bug 227780, r=timeless, sr=alecf git-svn-id: svn://10.0.0.236/trunk@150902 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/xpcom/ds/nsCOMArray.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mozilla/xpcom/ds/nsCOMArray.cpp b/mozilla/xpcom/ds/nsCOMArray.cpp index d66a729f041..9a2702232ec 100644 --- a/mozilla/xpcom/ds/nsCOMArray.cpp +++ b/mozilla/xpcom/ds/nsCOMArray.cpp @@ -115,8 +115,9 @@ nsCOMArray_base::ReplaceObjectAt(nsISupports* aObject, PRInt32 aIndex) // ReplaceElementAt could fail, such as if the array grows // so only release the existing object if the replacement succeeded if (result) { - NS_IF_RELEASE(oldObject); + // Make sure to addref first, in case aObject == oldObject NS_IF_ADDREF(aObject); + NS_IF_RELEASE(oldObject); } return result; }