fix for topcrash 218556: I made the object resize listener hold weak pointer to the editor to fix resize timer firings on stale editors. r=brade; sr=peterv

editor/libeditor/html/nsHTMLObjectResizer.cpp

@@ -74,9 +74,9 @@ class nsHTMLEditUtils;
 // ==================================================================
 NS_IMPL_ISUPPORTS1(DocumentResizeEventListener, nsIDOMEventListener)
 
-DocumentResizeEventListener::DocumentResizeEventListener(nsIHTMLEditor * aEditor) :
- mEditor(aEditor)
+DocumentResizeEventListener::DocumentResizeEventListener(nsIHTMLEditor * aEditor) 
 {
+  mEditor = do_GetWeakReference(aEditor);
 }
 
 DocumentResizeEventListener::~DocumentResizeEventListener()
@@ -86,8 +86,10 @@ DocumentResizeEventListener::~DocumentResizeEventListener()
 NS_IMETHODIMP
 DocumentResizeEventListener::HandleEvent(nsIDOMEvent* aMouseEvent)
 {
-  nsCOMPtr<nsIHTMLObjectResizer> objectResizer = do_QueryInterface(mEditor);
-  return objectResizer->RefreshResizers();
+  nsCOMPtr<nsIHTMLObjectResizer> objectResizer = do_QueryReferent(mEditor);
+  if (objectResizer)
+    return objectResizer->RefreshResizers();
+  return NS_OK;
 }
 
 // ==================================================================
@@ -96,9 +98,9 @@ DocumentResizeEventListener::HandleEvent(nsIDOMEvent* aMouseEvent)
 
 NS_IMPL_ISUPPORTS1(ResizerSelectionListener, nsISelectionListener)
 
-ResizerSelectionListener::ResizerSelectionListener(nsIHTMLEditor * aEditor) :
- mEditor(aEditor)
+ResizerSelectionListener::ResizerSelectionListener(nsIHTMLEditor * aEditor)
 {
+  mEditor = do_GetWeakReference(aEditor);
 }
 
 ResizerSelectionListener::~ResizerSelectionListener()
@@ -110,10 +112,13 @@ ResizerSelectionListener::NotifySelectionChanged(nsIDOMDocument *, nsISelection
 {
   if ((aReason & (nsISelectionListener::MOUSEDOWN_REASON |
                   nsISelectionListener::KEYPRESS_REASON |
-                  nsISelectionListener::SELECTALL_REASON)) && aSelection) {
+                  nsISelectionListener::SELECTALL_REASON)) && aSelection) 
+  {
     // the selection changed and we need to check if we have to
     // hide and/or redisplay resizing handles
-    mEditor->CheckSelectionStateForAnonymousButtons(aSelection);
+    nsCOMPtr<nsIHTMLEditor> editor = do_QueryReferent(mEditor);
+    if (editor)
+      editor->CheckSelectionStateForAnonymousButtons(aSelection);
   }
 
   return NS_OK;
@@ -125,9 +130,9 @@ ResizerSelectionListener::NotifySelectionChanged(nsIDOMDocument *, nsISelection
 
 NS_IMPL_ISUPPORTS2(ResizerMouseMotionListener, nsIDOMEventListener, nsIDOMMouseMotionListener)
 
-ResizerMouseMotionListener::ResizerMouseMotionListener(nsIHTMLEditor * aEditor):
- mEditor(aEditor)
+ResizerMouseMotionListener::ResizerMouseMotionListener(nsIHTMLEditor * aEditor)
 {
+  mEditor = do_GetWeakReference(aEditor);
 }
 
 ResizerMouseMotionListener::~ResizerMouseMotionListener() 
@@ -145,7 +150,7 @@ ResizerMouseMotionListener::MouseMove(nsIDOMEvent* aMouseEvent)
   }
 
   // Don't do anything special if not an HTML object resizer editor
-  nsCOMPtr<nsIHTMLObjectResizer> objectResizer = do_QueryInterface(mEditor);
+  nsCOMPtr<nsIHTMLObjectResizer> objectResizer = do_QueryReferent(mEditor);
   if (objectResizer)
   {
     // check if we have to redisplay a resizing shadow

editor/libeditor/html/nsHTMLObjectResizer.h

@@ -40,6 +40,7 @@
 #define _nshtmlobjectresizer__h
 
 #include "nsCOMPtr.h"
+#include "nsWeakReference.h"
 #include "nsIDOMNode.h"
 #include "nsIDOMElement.h"
 
@@ -82,7 +83,7 @@ public:
 
 protected:
 
-  nsIHTMLEditor * mEditor;
+  nsWeakPtr mEditor;
 };
 
 // ==================================================================
@@ -105,7 +106,7 @@ public:
   NS_IMETHOD DragMove(nsIDOMEvent* aMouseEvent);
 
  protected:
-  nsIHTMLEditor * mEditor;
+  nsWeakPtr mEditor;
 
 };
 
@@ -125,7 +126,7 @@ public:
   NS_DECL_NSIDOMEVENTLISTENER
 
  protected:
-  nsIHTMLEditor * mEditor;
+  nsWeakPtr mEditor;
 
 };