From eff2c123071f11e1b6d9cbb8f49d72968a4bdd8a Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Mon, 27 Apr 2015 15:29:22 -0400
Subject: [PATCH] Bug 1158452.  Pass in the right node when messing with font
 sizes in editor.  r=ehsan

---
 editor/libeditor/crashtests/1158452.html    | 10 ++++++++++
 editor/libeditor/crashtests/crashtests.list |  1 +
 editor/libeditor/nsHTMLEditorStyle.cpp      |  5 +----
 3 files changed, 12 insertions(+), 4 deletions(-)
 create mode 100644 editor/libeditor/crashtests/1158452.html

diff --git a/editor/libeditor/crashtests/1158452.html b/editor/libeditor/crashtests/1158452.html
new file mode 100644
index 00000000000..56c74abd612
--- /dev/null
+++ b/editor/libeditor/crashtests/1158452.html
@@ -0,0 +1,10 @@
+
+<div>
+<div>
+aaaaaaa
+</script>
+<script type="text/javascript"> 
+document.designMode = "on"
+window.getSelection().modify("extend", "backward", "line")
+document.execCommand("increasefontsize","",null);
+</script>
diff --git a/editor/libeditor/crashtests/crashtests.list b/editor/libeditor/crashtests/crashtests.list
index 03bf9d7ca9a..ae8e2a391c7 100644
--- a/editor/libeditor/crashtests/crashtests.list
+++ b/editor/libeditor/crashtests/crashtests.list
@@ -61,3 +61,4 @@ needs-focus load 793866.html
 load 1057677.html
 needs-focus load 1128787.html
 load 1134545.html
+load 1158452.html
diff --git a/editor/libeditor/nsHTMLEditorStyle.cpp b/editor/libeditor/nsHTMLEditorStyle.cpp
index 9eaf2d485a9..5e06917afe5 100644
--- a/editor/libeditor/nsHTMLEditorStyle.cpp
+++ b/editor/libeditor/nsHTMLEditorStyle.cpp
@@ -1502,11 +1502,8 @@ nsHTMLEditor::RelativeFontChange(FontSize aDir)
         NS_ENSURE_SUCCESS(res, res);
       }
       if (IsTextNode(endNode) && IsEditable(endNode)) {
-        nsCOMPtr<nsIDOMCharacterData> nodeAsText = do_QueryInterface(endNode);
-        int32_t endOffset;
-        range->GetEndOffset(&endOffset);
         res = RelativeFontChangeOnTextNode(aDir == FontSize::incr ? +1 : -1,
-            static_cast<nsIDOMCharacterData*>(startNode->AsDOMNode()),
+            static_cast<nsIDOMCharacterData*>(endNode->AsDOMNode()),
             0, range->EndOffset());
         NS_ENSURE_SUCCESS(res, res);
       }