Bug 885539 - Crash - Heap-use-after-free in nsTArray_base. r=bz

This commit is contained in:
Andrea Marchesini 2013-07-03 09:21:30 -04:00
parent 2f32b96e0b
commit a022e43e0e

View File

@ -218,7 +218,8 @@ nsNodeUtils::LastRelease(nsINode* aNode)
static_cast<nsGenericHTMLFormElement*>(aNode)->ClearForm(true);
}
if (aNode->IsElement() && aNode->AsElement()->IsHTML(nsGkAtoms::img)) {
if (aNode->IsElement() && aNode->AsElement()->IsHTML(nsGkAtoms::img) &&
aNode->HasFlag(ADDED_TO_FORM)) {
HTMLImageElement* imageElem = static_cast<HTMLImageElement*>(aNode);
imageElem->ClearForm(true);
}