From 88d87ddb403b8bac3bad86274c90acf05069fe36 Mon Sep 17 00:00:00 2001
From: Mats Palmgren <matspal@gmail.com>
Date: Tue, 3 Apr 2012 23:52:13 +0200
Subject: Bug 732941 - Deal with OOM when copying nsCOMArray. r=bz a=akeybl

---
 layout/generic/nsSelection.cpp |   15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/layout/generic/nsSelection.cpp b/layout/generic/nsSelection.cpp
index e2f5717..0cc826f 100644
--- a/layout/generic/nsSelection.cpp
+++ b/layout/generic/nsSelection.cpp
@@ -6678,24 +6678,23 @@ nsTypedSelection::NotifySelectionListeners()
   if (!mFrameSelection)
     return NS_OK;//nothing to do
  
-  if (mFrameSelection->GetBatching()){
+  if (mFrameSelection->GetBatching()) {
     mFrameSelection->SetDirty();
     return NS_OK;
   }
-  PRInt32 cnt = mSelectionListeners.Count();
   nsCOMArray<nsISelectionListener> selectionListeners(mSelectionListeners);
-  
+  PRInt32 cnt = selectionListeners.Count();
+  if (cnt != mSelectionListeners.Count()) {
+    return NS_ERROR_OUT_OF_MEMORY;  // nsCOMArray is fallible
+  }
   nsCOMPtr<nsIDOMDocument> domdoc;
   nsCOMPtr<nsIPresShell> shell;
   nsresult rv = GetPresShell(getter_AddRefs(shell));
   if (NS_SUCCEEDED(rv) && shell)
     domdoc = do_QueryInterface(shell->GetDocument());
   short reason = mFrameSelection->PopReason();
-  for (PRInt32 i = 0; i < cnt; i++)
-  {
-    nsISelectionListener* thisListener = selectionListeners[i];
-    if (thisListener)
-      thisListener->NotifySelectionChanged(domdoc, this, reason);
+  for (PRInt32 i = 0; i < cnt; i++) {
+    selectionListeners[i]->NotifySelectionChanged(domdoc, this, reason);
   }
   return NS_OK;
 }
-- 
1.7.10

