From 26e0feee633d487bea204ea5c802791c222c5ddd Mon Sep 17 00:00:00 2001
From: "bzbarsky%mit.edu" <bzbarsky%mit.edu>
Date: Sun, 12 Sep 2004 04:15:44 +0000
Subject: [PATCH] Fix crash in nsScrollBoxObject::::EnsureElementIsVisible. 
 Bug 257607, patch by Justin <justin@openaether.org>, r+sr=bzbarsky.

---
 layout/xul/base/src/nsScrollBoxObject.cpp | 30 +++++++++++++++++------
 1 file changed, 23 insertions(+), 7 deletions(-)

diff --git a/layout/xul/base/src/nsScrollBoxObject.cpp b/layout/xul/base/src/nsScrollBoxObject.cpp
index 9fd7b7040577..bd43e335c587 100644
--- a/layout/xul/base/src/nsScrollBoxObject.cpp
+++ b/layout/xul/base/src/nsScrollBoxObject.cpp
@@ -42,8 +42,8 @@
 #include "nsIContent.h"
 #include "nsIDocument.h"
 #include "nsIDOMDocument.h"
+#include "nsIDOMNSDocument.h"
 #include "nsIDOMElement.h"
-#include "nsIDOMXULElement.h"
 #include "nsPresContext.h"
 #include "nsIFrame.h"
 #include "nsIScrollableView.h"
@@ -229,6 +229,7 @@ NS_IMETHODIMP nsScrollBoxObject::ScrollToLine(PRInt32 line)
 /* void scrollToElement (in nsIDOMElement child); */
 NS_IMETHODIMP nsScrollBoxObject::ScrollToElement(nsIDOMElement *child)
 {
+    NS_ENSURE_ARG_POINTER(child);
     nsIScrollableView* scrollableView = GetScrollableView();
     if (!scrollableView)
        return NS_ERROR_FAILURE;
@@ -242,9 +243,16 @@ NS_IMETHODIMP nsScrollBoxObject::ScrollToElement(nsIDOMElement *child)
        return NS_ERROR_FAILURE;
 
     nsRect rect, crect;
-    nsCOMPtr<nsIDOMXULElement> childDOMXULElement (do_QueryInterface(child));
-    nsIBoxObject * childBoxObject;
-    childDOMXULElement->GetBoxObject(&childBoxObject);
+    nsCOMPtr<nsIDOMDocument> doc;
+    child->GetOwnerDocument(getter_AddRefs(doc));
+    nsCOMPtr<nsIDOMNSDocument> nsDoc(do_QueryInterface(doc));
+    if(!nsDoc)
+      return NS_ERROR_UNEXPECTED;
+
+    nsCOMPtr<nsIBoxObject> childBoxObject;
+    nsDoc->GetBoxObjectFor(child, getter_AddRefs(childBoxObject));
+    if(!childBoxObject)
+      return NS_ERROR_UNEXPECTED;
 
     PRInt32 x,y;
     childBoxObject->GetX(&x);
@@ -302,6 +310,7 @@ NS_IMETHODIMP nsScrollBoxObject::GetScrolledSize(PRInt32 *width, PRInt32 *height
 /* void ensureElementIsVisible (in nsIDOMElement child); */
 NS_IMETHODIMP nsScrollBoxObject::EnsureElementIsVisible(nsIDOMElement *child)
 {
+    NS_ENSURE_ARG_POINTER(child);
     nsIScrollableView* scrollableView = GetScrollableView();
     if (!scrollableView)
        return NS_ERROR_FAILURE;
@@ -315,9 +324,16 @@ NS_IMETHODIMP nsScrollBoxObject::EnsureElementIsVisible(nsIDOMElement *child)
        return NS_ERROR_FAILURE;
 
     nsRect rect, crect;
-    nsCOMPtr<nsIDOMXULElement> childDOMXULElement (do_QueryInterface(child));
-    nsIBoxObject * childBoxObject;
-    childDOMXULElement->GetBoxObject(&childBoxObject);
+    nsCOMPtr<nsIDOMDocument> doc;
+    child->GetOwnerDocument(getter_AddRefs(doc));
+    nsCOMPtr<nsIDOMNSDocument> nsDoc(do_QueryInterface(doc));
+    if(!nsDoc)
+        return NS_ERROR_UNEXPECTED;
+
+    nsCOMPtr<nsIBoxObject> childBoxObject;
+    nsDoc->GetBoxObjectFor(child, getter_AddRefs(childBoxObject));
+    if(!childBoxObject)
+      return NS_ERROR_UNEXPECTED;
 
     PRInt32 x,y,width,height;
     childBoxObject->GetX(&x);