Bug 763626 r=bz

2012-06-11 22:51:27 -07:00 · 2012-06-11 22:51:27 -07:00 · 807ff1b8f1
--- a/content/html/content/src/nsGenericHTMLElement.cpp
+++ b/content/html/content/src/nsGenericHTMLElement.cpp
@ -4187,7 +4187,8 @@ nsDOMSettableTokenListPropertyDestructor(void *aObject, nsIAtom *aProperty,
 {
  nsDOMSettableTokenList* list =
    static_cast<nsDOMSettableTokenList*>(aPropertyValue);
-  NS_IF_RELEASE(list);
+  list->DropReference();
+  NS_RELEASE(list);
 }

 nsDOMSettableTokenList*
--- a/content/html/content/test/Makefile.in
+++ b/content/html/content/test/Makefile.in
@ -265,6 +265,7 @@ _TEST_FILES = \
 		test_bug742549.html \
 		test_bug745685.html \
 		test_input_file_picker.html \
+		test_bug763626.html \
 		$(NULL)

 _BROWSER_TEST_FILES = \
--- a/content/html/content/test/test_bug763626.html
+++ b/content/html/content/test/test_bug763626.html
@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=763626
+-->
+<head>
+<title>Test for Bug 763626</title>
+
+<script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+
+<script type="application/javascript">
+
+SimpleTest.waitForExplicitFinish();
+
+function boom()
+{
+  var r = document.createElement("div").itemRef;
+  SpecialPowers.DOMWindowUtils.garbageCollect();
+  is("" + r, "", "ToString should return empty string when element is gone");
+  SimpleTest.finish();
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
+