From be252a8dce0d09586287a28c7ef595fb9ff8deed Mon Sep 17 00:00:00 2001
From: Aryeh Gregor <ayg@aryeh.name>
Date: Fri, 13 Jul 2012 09:33:42 +0300
Subject: [PATCH] Bug 775552 - Don't access siblings of nodes that might be
 deleted; r=ehsan

---
 editor/libeditor/html/nsHTMLEditRules.cpp | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/editor/libeditor/html/nsHTMLEditRules.cpp b/editor/libeditor/html/nsHTMLEditRules.cpp
index ce32ac4e950..a867b1ded84 100644
--- a/editor/libeditor/html/nsHTMLEditRules.cpp
+++ b/editor/libeditor/html/nsHTMLEditRules.cpp
@@ -2834,10 +2834,8 @@ nsHTMLEditRules::DeleteNonTableElements(nsINode* aNode)
     return mHTMLEditor->DeleteNode(aNode->AsDOMNode());
   }
 
-  for (nsCOMPtr<nsIContent> child = aNode->GetLastChild();
-       child;
-       child = child->GetPreviousSibling()) {
-    nsresult rv = DeleteNonTableElements(child);
+  for (PRInt32 i = aNode->GetChildCount() - 1; i >= 0; --i) {
+    nsresult rv = DeleteNonTableElements(aNode->GetChildAt(i));
     NS_ENSURE_SUCCESS(rv, rv);
   }
   return NS_OK;