Fix for bug 395340 (Crash [@ nsINode::GetNodeParent] with CSS counters and contentEditable). r/sr=bz, a=endgame.

content/base/src/nsDocument.h

@@ -792,6 +792,9 @@ protected:
 
   nsString mBaseTarget;
 
+  // Our update nesting level
+  PRUint32 mUpdateNestLevel;
+
 private:
   friend class nsUnblockOnloadEvent;
 
@@ -833,9 +836,6 @@ private:
 
   // Member to store out last-selected stylesheet set.
   nsString mLastStyleSheetSet;
-
-  // Our update nesting level
-  PRUint32 mUpdateNestLevel;
 };
 
 

content/html/document/src/nsHTMLDocument.cpp

@@ -3732,6 +3732,16 @@ nsHTMLDocument::GetDesignMode(nsAString & aDesignMode)
   return NS_OK;
 }
 
+void
+nsHTMLDocument::EndUpdate(nsUpdateType aUpdateType)
+{
+  nsDocument::EndUpdate(aUpdateType);
+
+  if (mUpdateNestLevel == 0 && EditingShouldBeOn() != IsEditingOn()) {
+    EditingStateChanged();
+  }
+}
+
 nsresult
 nsHTMLDocument::ChangeContentEditableCount(nsIContent *aElement,
                                            PRInt32 aChange)
@@ -3741,7 +3751,8 @@ nsHTMLDocument::ChangeContentEditableCount(nsIContent *aElement,
 
   mContentEditableCount += aChange;
 
-  if (mParser) {
+  if (mParser ||
+      (mUpdateNestLevel > 0 && EditingShouldBeOn() != IsEditingOn())) {
     return NS_OK;
   }
 

content/html/document/src/nsHTMLDocument.h

@@ -212,6 +212,17 @@ public:
     mDisableCookieAccess = PR_TRUE;
   }
 
+  /**
+   * Returns whether the document should be editable. This can be different from
+   * IsEditingOn() (for example if we're delaying turning the editor on/off).
+   */
+  PRBool EditingShouldBeOn()
+  {
+    return HasFlag(NODE_IS_EDITABLE) || mContentEditableCount > 0;
+  }
+
+  void EndUpdate(nsUpdateType aUpdateType);
+
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED_NO_UNLINK(nsHTMLDocument, nsDocument)
 
 protected: