diff --git a/mozilla/docshell/base/crashtests/432114-1.html b/mozilla/docshell/base/crashtests/432114-1.html
new file mode 100644
index 00000000000..0716c8a30bf
--- /dev/null
+++ b/mozilla/docshell/base/crashtests/432114-1.html
@@ -0,0 +1,8 @@
+
+
+Bug - Crash [@ PL_DHashTableOperate] with DOMNodeInserted event listener removing window and frameset contenteditable
+
+
+
+
+
diff --git a/mozilla/docshell/base/crashtests/432114-2.html b/mozilla/docshell/base/crashtests/432114-2.html
new file mode 100644
index 00000000000..8106e00d192
--- /dev/null
+++ b/mozilla/docshell/base/crashtests/432114-2.html
@@ -0,0 +1,9 @@
+
+
+testcase2 Bug 432114 Crash [@ PL_DHashTableOperate] with DOMNodeInserted event listener removing window and frameset contenteditable
+
+
+
+
+
+
diff --git a/mozilla/docshell/base/crashtests/crashtests.list b/mozilla/docshell/base/crashtests/crashtests.list
index 23ab439ff78..9a6c831dc68 100644
--- a/mozilla/docshell/base/crashtests/crashtests.list
+++ b/mozilla/docshell/base/crashtests/crashtests.list
@@ -1,2 +1,4 @@
load 369126-1.html
load 403574-1.xhtml
+load 432114-1.html
+load 432114-2.html
diff --git a/mozilla/docshell/base/nsWebShell.cpp b/mozilla/docshell/base/nsWebShell.cpp
index 5778b72696d..bfac64a8483 100644
--- a/mozilla/docshell/base/nsWebShell.cpp
+++ b/mozilla/docshell/base/nsWebShell.cpp
@@ -588,18 +588,16 @@ nsWebShell::EnsureCommandHandler()
{
if (!mCommandManager)
{
- mCommandManager = do_CreateInstance("@mozilla.org/embedcomp/command-manager;1");
- if (!mCommandManager) return NS_ERROR_OUT_OF_MEMORY;
+ nsCOMPtr commandUpdater =
+ do_CreateInstance("@mozilla.org/embedcomp/command-manager;1");
+ if (!commandUpdater) return NS_ERROR_OUT_OF_MEMORY;
- nsCOMPtr commandUpdater = do_QueryInterface(mCommandManager);
- if (!commandUpdater) return NS_ERROR_FAILURE;
-
- nsCOMPtr domWindow = do_GetInterface(static_cast(this));
-#ifdef DEBUG
- nsresult rv =
-#endif
- commandUpdater->Init(domWindow);
- NS_ASSERTION(NS_SUCCEEDED(rv), "Initting command manager failed");
+ nsCOMPtr domWindow =
+ do_GetInterface(static_cast(this));
+
+ nsresult rv = commandUpdater->Init(domWindow);
+ if (NS_SUCCEEDED(rv))
+ mCommandManager = do_QueryInterface(commandUpdater);
}
return mCommandManager ? NS_OK : NS_ERROR_FAILURE;
diff --git a/mozilla/editor/libeditor/base/nsEditor.cpp b/mozilla/editor/libeditor/base/nsEditor.cpp
index b10371701d3..5eaa2eb5772 100644
--- a/mozilla/editor/libeditor/base/nsEditor.cpp
+++ b/mozilla/editor/libeditor/base/nsEditor.cpp
@@ -4368,7 +4368,7 @@ nsresult nsEditor::EndUpdateViewBatch()
// the reflows we caused will get processed before the invalidates.
if (flags & nsIPlaintextEditor::eEditorUseAsyncUpdatesMask) {
updateFlag = NS_VMREFRESH_DEFERRED;
- } else {
+ } else if (presShell) {
// Flush out layout. Need to do this because if we have no invalidates
// to flush the viewmanager code won't flush our reflow here, and we
// have selection code that does sync caret scrolling in this case.
diff --git a/mozilla/editor/libeditor/html/nsHTMLEditor.cpp b/mozilla/editor/libeditor/html/nsHTMLEditor.cpp
index 5d90c937631..5d1539a2025 100644
--- a/mozilla/editor/libeditor/html/nsHTMLEditor.cpp
+++ b/mozilla/editor/libeditor/html/nsHTMLEditor.cpp
@@ -3626,12 +3626,6 @@ nsHTMLEditor::AddOverrideStyleSheet(const nsAString& aURL)
// (This checks if already exists)
ps->AddOverrideStyleSheet(sheet);
- // Save doc pointer to be able to use nsIStyleSheet::SetEnabled()
- nsIDocument *document = ps->GetDocument();
- if (!document)
- return NS_ERROR_NULL_POINTER;
- sheet->SetOwningDocument(document);
-
ps->ReconstructStyleData();
// Save as the last-loaded sheet
@@ -3696,21 +3690,32 @@ nsHTMLEditor::EnableStyleSheet(const nsAString &aURL, PRBool aEnable)
nsCOMPtr domSheet(do_QueryInterface(sheet));
NS_ASSERTION(domSheet, "Sheet not implementing nsIDOMStyleSheet!");
+
+ // Ensure the style sheet is owned by our document.
+ nsCOMPtr doc = do_QueryInterface(mDocWeak);
+ rv = sheet->SetOwningDocument(doc);
+ NS_ENSURE_SUCCESS(rv, rv);
return domSheet->SetDisabled(!aEnable);
}
-
PRBool
nsHTMLEditor::EnableExistingStyleSheet(const nsAString &aURL)
{
nsCOMPtr sheet;
nsresult rv = GetStyleSheetForURL(aURL, getter_AddRefs(sheet));
- NS_ENSURE_SUCCESS(rv, rv);
+ if (NS_FAILED(rv))
+ return PR_FALSE;
// Enable sheet if already loaded.
if (sheet)
{
+ // Ensure the style sheet is owned by our document.
+ nsCOMPtr doc = do_QueryInterface(mDocWeak);
+ rv = sheet->SetOwningDocument(doc);
+ if (NS_FAILED(rv))
+ return PR_FALSE;
+
nsCOMPtr domSheet(do_QueryInterface(sheet));
NS_ASSERTION(domSheet, "Sheet not implementing nsIDOMStyleSheet!");