From 8d88c68a9d7e47164456991e511ce6b2400366d5 Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Thu, 9 Mar 2017 14:44:04 -0500
Subject: [PATCH] Bug 1343037 part 4.  Fix type changes on an input to properly
 grab the selection offsets from the old editor before we ask the editor state
 for them.  r=ehsan

MozReview-Commit-ID: IDdt0qedJpT
---
 dom/html/HTMLInputElement.cpp  | 1 +
 dom/html/nsTextEditorState.cpp | 8 ++++++++
 dom/html/nsTextEditorState.h   | 4 ++++
 3 files changed, 13 insertions(+)

diff --git a/dom/html/HTMLInputElement.cpp b/dom/html/HTMLInputElement.cpp
index 42a5a973462d..5c4412528261 100644
--- a/dom/html/HTMLInputElement.cpp
+++ b/dom/html/HTMLInputElement.cpp
@@ -5136,6 +5136,7 @@ HTMLInputElement::HandleTypeChange(uint8_t aNewType)
   nsTextEditorState::SelectionProperties sp;
 
   if (GetEditorState()) {
+    mInputData.mState->SyncUpSelectionPropertiesBeforeDestruction();
     sp = mInputData.mState->GetSelectionProperties();
   }
 
diff --git a/dom/html/nsTextEditorState.cpp b/dom/html/nsTextEditorState.cpp
index 6976f00e4f4f..e4b63c8dbeab 100644
--- a/dom/html/nsTextEditorState.cpp
+++ b/dom/html/nsTextEditorState.cpp
@@ -1537,6 +1537,14 @@ nsTextEditorState::GetSelectionProperties()
   return mSelectionProperties;
 }
 
+void
+nsTextEditorState::SyncUpSelectionPropertiesBeforeDestruction()
+{
+  if (mBoundFrame) {
+    UnbindFromFrame(mBoundFrame);
+  }
+}
+
 void
 nsTextEditorState::SetSelectionProperties(nsTextEditorState::SelectionProperties& aProps)
 {
diff --git a/dom/html/nsTextEditorState.h b/dom/html/nsTextEditorState.h
index b07de4842e2e..33b541a402f4 100644
--- a/dom/html/nsTextEditorState.h
+++ b/dom/html/nsTextEditorState.h
@@ -261,6 +261,10 @@ public:
   void SetSelectionProperties(SelectionProperties& aProps);
   void WillInitEagerly() { mSelectionRestoreEagerInit = true; }
   bool HasNeverInitializedBefore() const { return !mEverInited; }
+  // Sync up our selection properties with our editor prior to being destroyed.
+  // This will invoke UnbindFromFrame() to ensure that we grab whatever
+  // selection state may be at the moment.
+  void SyncUpSelectionPropertiesBeforeDestruction();
 
   // Get the selection range start and end points in our text.
   nsresult GetSelectionRange(int32_t* aSelectionStart, int32_t* aSelectionEnd);