From e1cd6e87e70f658ab48b1da244f17dadfe91c292 Mon Sep 17 00:00:00 2001
From: "tague%netscape.com" <tague%netscape.com>
Date: Wed, 14 Jul 1999 21:10:55 +0000
Subject: [PATCH] Fixed bug #8227 deref errors in tempDOMTextRange

---
 content/events/src/nsDOMEvent.cpp | 22 +++++++++++++---------
 layout/events/src/nsDOMEvent.cpp  | 22 +++++++++++++---------
 2 files changed, 26 insertions(+), 18 deletions(-)

diff --git a/content/events/src/nsDOMEvent.cpp b/content/events/src/nsDOMEvent.cpp
index 135ec8e20c2..0358cb9229e 100644
--- a/content/events/src/nsDOMEvent.cpp
+++ b/content/events/src/nsDOMEvent.cpp
@@ -63,16 +63,20 @@ nsDOMEvent::nsDOMEvent(nsIPresContext* aPresContext, nsEvent* aEvent) {
 	  //  will hold a ref, the widget representation isn't persistent
 	  //
 	  nsIDOMTextRange** tempTextRangeList = new nsIDOMTextRange*[((nsTextEvent*)aEvent)->rangeCount];
-	  for(PRUint16 i=0;i<((nsTextEvent*)aEvent)->rangeCount;i++) {
-		  nsDOMTextRange* tempDOMTextRange = new nsDOMTextRange((((nsTextEvent*)aEvent)->rangeArray[i]).mStartOffset,
-													(((nsTextEvent*)aEvent)->rangeArray[i]).mEndOffset,
-													(((nsTextEvent*)aEvent)->rangeArray[i]).mRangeType);
-		  tempDOMTextRange->AddRef();
-		  tempTextRangeList[i] = (nsIDOMTextRange*)tempDOMTextRange;
-	  }
+	  if (tempTextRangeList!=nsnull) {
+		for(PRUint16 i=0;i<((nsTextEvent*)aEvent)->rangeCount;i++) {
+			nsDOMTextRange* tempDOMTextRange = new nsDOMTextRange((((nsTextEvent*)aEvent)->rangeArray[i]).mStartOffset,
+														(((nsTextEvent*)aEvent)->rangeArray[i]).mEndOffset,
+														(((nsTextEvent*)aEvent)->rangeArray[i]).mRangeType);
+			if (tempDOMTextRange!=nsnull) {
+				tempDOMTextRange->AddRef();
+				tempTextRangeList[i] = (nsIDOMTextRange*)tempDOMTextRange;
+			}
+		}
 		
-	  mTextRange = (nsIDOMTextRangeList*) new nsDOMTextRangeList(((nsTextEvent*)aEvent)->rangeCount,tempTextRangeList);
-	  mTextRange->AddRef();
+		mTextRange = (nsIDOMTextRangeList*) new nsDOMTextRangeList(((nsTextEvent*)aEvent)->rangeCount,tempTextRangeList);
+		if (mTextRange!=nsnull)  mTextRange->AddRef();
+	  }
   }
 
   NS_INIT_REFCNT();
diff --git a/layout/events/src/nsDOMEvent.cpp b/layout/events/src/nsDOMEvent.cpp
index 135ec8e20c2..0358cb9229e 100644
--- a/layout/events/src/nsDOMEvent.cpp
+++ b/layout/events/src/nsDOMEvent.cpp
@@ -63,16 +63,20 @@ nsDOMEvent::nsDOMEvent(nsIPresContext* aPresContext, nsEvent* aEvent) {
 	  //  will hold a ref, the widget representation isn't persistent
 	  //
 	  nsIDOMTextRange** tempTextRangeList = new nsIDOMTextRange*[((nsTextEvent*)aEvent)->rangeCount];
-	  for(PRUint16 i=0;i<((nsTextEvent*)aEvent)->rangeCount;i++) {
-		  nsDOMTextRange* tempDOMTextRange = new nsDOMTextRange((((nsTextEvent*)aEvent)->rangeArray[i]).mStartOffset,
-													(((nsTextEvent*)aEvent)->rangeArray[i]).mEndOffset,
-													(((nsTextEvent*)aEvent)->rangeArray[i]).mRangeType);
-		  tempDOMTextRange->AddRef();
-		  tempTextRangeList[i] = (nsIDOMTextRange*)tempDOMTextRange;
-	  }
+	  if (tempTextRangeList!=nsnull) {
+		for(PRUint16 i=0;i<((nsTextEvent*)aEvent)->rangeCount;i++) {
+			nsDOMTextRange* tempDOMTextRange = new nsDOMTextRange((((nsTextEvent*)aEvent)->rangeArray[i]).mStartOffset,
+														(((nsTextEvent*)aEvent)->rangeArray[i]).mEndOffset,
+														(((nsTextEvent*)aEvent)->rangeArray[i]).mRangeType);
+			if (tempDOMTextRange!=nsnull) {
+				tempDOMTextRange->AddRef();
+				tempTextRangeList[i] = (nsIDOMTextRange*)tempDOMTextRange;
+			}
+		}
 		
-	  mTextRange = (nsIDOMTextRangeList*) new nsDOMTextRangeList(((nsTextEvent*)aEvent)->rangeCount,tempTextRangeList);
-	  mTextRange->AddRef();
+		mTextRange = (nsIDOMTextRangeList*) new nsDOMTextRangeList(((nsTextEvent*)aEvent)->rangeCount,tempTextRangeList);
+		if (mTextRange!=nsnull)  mTextRange->AddRef();
+	  }
   }
 
   NS_INIT_REFCNT();