Fix for bug 17937. nsHTMLEditor::DeleteSelectionAndCreateNode() wasn't addref'ing an out parameter. r=sfraser.

editor/base/nsHTMLEditor.cpp

@@ -1634,6 +1634,7 @@ nsHTMLEditor::DeleteSelectionAndCreateNode(const nsString& aTag,
                       getter_AddRefs(newNode));
   // XXX: ERROR_HANDLING  check result, and make sure aNewNode is set correctly in success/failure cases
   *aNewNode = newNode;
+  NS_IF_ADDREF(*aNewNode);
 
   // we want the selection to be just after the new node
   nsCOMPtr<nsIDOMSelection> selection;

editor/libeditor/html/nsHTMLEditor.cpp

@@ -1634,6 +1634,7 @@ nsHTMLEditor::DeleteSelectionAndCreateNode(const nsString& aTag,
                       getter_AddRefs(newNode));
   // XXX: ERROR_HANDLING  check result, and make sure aNewNode is set correctly in success/failure cases
   *aNewNode = newNode;
+  NS_IF_ADDREF(*aNewNode);
 
   // we want the selection to be just after the new node
   nsCOMPtr<nsIDOMSelection> selection;