2006-07-20 Anders Carlsson <acarlsson@apple.com>

        Reviewed by Darin.

        * bridge/mac/FrameMac.mm:
        (WebCore::FrameMac::nextKeyViewInFrame):
        Hold a ref to the node in case it gets destroyed by an event handler.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@15541 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 9eeca5ecf1e2643c5b6ac3b54a1d8c8a56e69ccb..db83ea968d25a00c93d65d7601135e1007eedcfd 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,11 @@
+2006-07-20  Anders Carlsson  <acarlsson@apple.com>
+
+        Reviewed by Darin.
+
+        * bridge/mac/FrameMac.mm:
+        (WebCore::FrameMac::nextKeyViewInFrame):
+        Hold a ref to the node in case it gets destroyed by an event handler.
+
 2006-07-19  Mark Rowe  <opendarwin.org@bdash.net.nz>
 
         Reviewed by Darin.

diff --git a/WebCore/bridge/mac/FrameMac.mm b/WebCore/bridge/mac/FrameMac.mm
index c969956b2cafe83de3f63fcd8a2f052b362a288a..a587b93995e491aa26535506a480eb9b3acaf7e7 100644 (file)
--- a/WebCore/bridge/mac/FrameMac.mm
+++ b/WebCore/bridge/mac/FrameMac.mm
@@ -877,22 +877,23 @@ String FrameMac::mimeTypeForFileName(const String& fileName) const
     return String();
 }
 
-NSView* FrameMac::nextKeyViewInFrame(Node* node, SelectionDirection direction, bool* focusCallResultedInViewBeingCreated)
+NSView* FrameMac::nextKeyViewInFrame(Node* n, SelectionDirection direction, bool* focusCallResultedInViewBeingCreated)
 {
     Document* doc = document();
     if (!doc)
         return nil;
     
+    RefPtr<Node> node = n;
     for (;;) {
         node = direction == SelectingNext
-            ? doc->nextFocusNode(node) : doc->previousFocusNode(node);
+            ? doc->nextFocusNode(node.get()) : doc->previousFocusNode(node.get());
         if (!node)
             return nil;
         
         RenderObject* renderer = node->renderer();
         
         if (!renderer->isWidget()) {
-            static_cast<Element*>(node)->focus(); 
+            static_cast<Element*>(node.get())->focus(); 
             // The call to focus might have triggered event handlers that causes the 
             // current renderer to be destroyed.
             if (!(renderer = node->renderer()))