Bug 795804 - Use WeakPtr for nsTextEditorState where appropriate; r=ehsan

content/html/content/src/nsTextEditorState.cpp

@@ -1010,29 +1010,31 @@ public:
   PrepareEditorEvent(nsTextEditorState &aState,
                      nsIContent *aOwnerContent,
                      const nsAString &aCurrentValue)
-    : mState(aState)
+    : mState(aState.asWeakPtr())
     , mOwnerContent(aOwnerContent)
     , mCurrentValue(aCurrentValue)
   {
-    mState.mValueTransferInProgress = true;
+    aState.mValueTransferInProgress = true;
   }
 
   NS_IMETHOD Run() {
+    NS_ENSURE_TRUE(mState, NS_ERROR_NULL_POINTER);
+
     // Transfer the saved value to the editor if we have one
     const nsAString *value = nullptr;
     if (!mCurrentValue.IsEmpty()) {
       value = &mCurrentValue;
     }
 
-    mState.PrepareEditor(value);
+    mState->PrepareEditor(value);
 
-    mState.mValueTransferInProgress = false;
+    mState->mValueTransferInProgress = false;
 
     return NS_OK;
   }
 
 private:
-  nsTextEditorState &mState;
+  WeakPtr<nsTextEditorState> mState;
   nsCOMPtr<nsIContent> mOwnerContent; // strong reference
   nsAutoString mCurrentValue;
 };

content/html/content/src/nsTextEditorState.h

@@ -13,6 +13,7 @@
 #include "nsITextControlFrame.h"
 #include "nsCycleCollectionParticipant.h"
 #include "nsIContent.h"
+#include "mozilla/WeakPtr.h"
 
 class nsTextInputListener;
 class nsTextControlFrame;
@@ -117,7 +118,7 @@ class nsITextControlElement;
 
 class RestoreSelectionState;
 
-class nsTextEditorState {
+class nsTextEditorState : public mozilla::SupportsWeakPtr<nsTextEditorState> {
 public:
   explicit nsTextEditorState(nsITextControlElement* aOwningElement);
   ~nsTextEditorState();