From fff2cf22d242de9cdd7c285eb20fc81d0d8df150 Mon Sep 17 00:00:00 2001
From: "darin%meer.net" <darin%meer.net@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Mon, 30 Jan 2006 17:16:50 +0000
Subject: [PATCH] fixes bug 324981 "nsTArray crash in RemoveElement"
 r=bsmedberg

git-svn-id: svn://10.0.0.236/trunk@188465 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/xpcom/glue/nsTArray.h      | 2 +-
 mozilla/xpcom/tests/TestTArray.cpp | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/mozilla/xpcom/glue/nsTArray.h b/mozilla/xpcom/glue/nsTArray.h
index ed1a4685aeb..1e63cf2cbe1 100644
--- a/mozilla/xpcom/glue/nsTArray.h
+++ b/mozilla/xpcom/glue/nsTArray.h
@@ -473,7 +473,7 @@ class nsTArray : public nsTArray_base {
     template<class Item, class Comparator>
     void RemoveElement(const Item& item, const Comparator& comp) {
       index_type i = IndexOf(item, 0, comp);
-      if (i >= 0) 
+      if (i != NoIndex)
         RemoveElementAt(i);
     }
 
diff --git a/mozilla/xpcom/tests/TestTArray.cpp b/mozilla/xpcom/tests/TestTArray.cpp
index ee3869dec76..cb4c4a13266 100644
--- a/mozilla/xpcom/tests/TestTArray.cpp
+++ b/mozilla/xpcom/tests/TestTArray.cpp
@@ -121,6 +121,10 @@ static PRBool test_basic_array(ElementType *data,
   ary.AppendElements(nsnull, 0);
   ary.AppendElements(empty);
 
+  // See bug 324981
+  ary.RemoveElement(extra);
+  ary.RemoveElement(extra);
+
   return PR_TRUE;
 }