Bug 143903 crash if I close the mail window while a save as dialog is open for a message attachment

patch by antonio.xu@sun.com r=dbaron sr=waterson

layout/base/nsCSSFrameConstructor.cpp

@@ -8049,7 +8049,8 @@ nsCSSFrameConstructor::FindPreviousSibling(nsIPresShell*     aPresShell,
   NS_ASSERTION(aPresShell && aContainer, "null arguments");
 
   ChildIterator first, iter;
-  ChildIterator::Init(aContainer, &first, &iter);
+  nsresult rv = ChildIterator::Init(aContainer, &first, &iter);
+  NS_ENSURE_SUCCESS(rv, nsnull);
   iter.seek(aIndexInContainer);
 
   PRUint8 childDisplay = UNSET_DISPLAY;
@@ -8115,7 +8116,8 @@ nsCSSFrameConstructor::FindNextSibling(nsIPresShell*     aPresShell,
                                        const nsIContent* aChild)
 {
   ChildIterator iter, last;
-  ChildIterator::Init(aContainer, &iter, &last);
+  nsresult rv = ChildIterator::Init(aContainer, &iter, &last);
+  NS_ENSURE_SUCCESS(rv, nsnull);
   iter.seek(aIndexInContainer);
 
   // Catch the case where someone tries to append

layout/base/nsChildIterator.cpp

@@ -45,6 +45,10 @@ ChildIterator::Init(nsIContent*    aContent,
                     ChildIterator* aFirst,
                     ChildIterator* aLast)
 {
+  // Initialize out parameters to be equal, in case of failure.
+  aFirst->mContent = aLast->mContent = nsnull;
+  aFirst->mIndex   = aLast->mIndex   = 0;
+  
   NS_PRECONDITION(aContent != nsnull, "no content");
   if (! aContent)
     return NS_ERROR_NULL_POINTER;

layout/html/style/src/nsCSSFrameConstructor.cpp

@@ -8049,7 +8049,8 @@ nsCSSFrameConstructor::FindPreviousSibling(nsIPresShell*     aPresShell,
   NS_ASSERTION(aPresShell && aContainer, "null arguments");
 
   ChildIterator first, iter;
-  ChildIterator::Init(aContainer, &first, &iter);
+  nsresult rv = ChildIterator::Init(aContainer, &first, &iter);
+  NS_ENSURE_SUCCESS(rv, nsnull);
   iter.seek(aIndexInContainer);
 
   PRUint8 childDisplay = UNSET_DISPLAY;
@@ -8115,7 +8116,8 @@ nsCSSFrameConstructor::FindNextSibling(nsIPresShell*     aPresShell,
                                        const nsIContent* aChild)
 {
   ChildIterator iter, last;
-  ChildIterator::Init(aContainer, &iter, &last);
+  nsresult rv = ChildIterator::Init(aContainer, &iter, &last);
+  NS_ENSURE_SUCCESS(rv, nsnull);
   iter.seek(aIndexInContainer);
 
   // Catch the case where someone tries to append

layout/html/style/src/nsChildIterator.cpp

@@ -45,6 +45,10 @@ ChildIterator::Init(nsIContent*    aContent,
                     ChildIterator* aFirst,
                     ChildIterator* aLast)
 {
+  // Initialize out parameters to be equal, in case of failure.
+  aFirst->mContent = aLast->mContent = nsnull;
+  aFirst->mIndex   = aLast->mIndex   = 0;
+  
   NS_PRECONDITION(aContent != nsnull, "no content");
   if (! aContent)
     return NS_ERROR_NULL_POINTER;