From f3a5bc0fb548ad459f1abb98a13075aecbc01e53 Mon Sep 17 00:00:00 2001
From: "hpradhan%hotpop.com"
 <hpradhan%hotpop.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Fri, 10 Jan 2003 12:31:41 +0000
Subject: [PATCH] bug 185073: mozilla crashes on
 http://www.kccommunications.com/ r=caillon sr=jst

git-svn-id: svn://10.0.0.236/trunk@136157 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/content/html/document/src/nsHTMLContentSink.cpp | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/mozilla/content/html/document/src/nsHTMLContentSink.cpp b/mozilla/content/html/document/src/nsHTMLContentSink.cpp
index 65d0aa7984c..bfa0b21f48e 100644
--- a/mozilla/content/html/document/src/nsHTMLContentSink.cpp
+++ b/mozilla/content/html/document/src/nsHTMLContentSink.cpp
@@ -5601,7 +5601,11 @@ HTMLContentSink::ProcessSCRIPTTag(const nsIParserNode& aNode)
   if (mCurrentContext->mStackPos <= 0) {
     return NS_ERROR_FAILURE;
   }
-  nsIHTMLContent* parent =
+
+  // Inserting the element into the document may execute a script.
+  // This can potentially make the parent go away. So, hold
+  // on to it till we are done.
+  nsCOMPtr<nsIHTMLContent> parent =
     mCurrentContext->mStack[mCurrentContext->mStackPos - 1].mContent;
   nsCOMPtr<nsIHTMLContent> element;
   nsCOMPtr<nsINodeInfo> nodeInfo;