fix usage of iterator when iterator's erase function is used (Bug #812018)

Fixed bugs:
  - https://launchpad.net/bugs/812018

(bzr r10706)

4 files changed, 32 insertions, 20 deletions

diff --git a/src/dom/css.h b/src/dom/css.h
index 5ea71ce95..4459a1006 100644
--- a/src/dom/css.h
+++ b/src/dom/css.h
@@ -639,11 +639,14 @@ public:
                                      throw (dom::DOMException)
         {
         std::vector<CSSStyleDeclarationEntry>::iterator iter;
-        for (iter=items.begin() ; iter!=items.end() ; ++iter)
-            {
-            if (iter->name == propertyName)
-                items.erase(iter);
+        for (iter=items.begin() ; iter!=items.end() ; ){
+            if (iter->name == propertyName){
+                iter = items.erase(iter);
             }
+            else{
+                ++iter;
+            }
+        }
         return propertyName;
         }
 
diff --git a/src/dom/events.h b/src/dom/events.h
index c4000ec29..b44df6dcd 100644
--- a/src/dom/events.h
+++ b/src/dom/events.h
@@ -510,17 +510,20 @@ public:
     virtual void removeEventListener(const DOMString &type,
                                      const EventListener *listener,
                                      bool useCapture)
-        {
+    {
         std::vector<EventListenerEntry>::iterator iter;
-        for (iter = listeners.begin() ; iter != listeners.end() ; ++iter)
-            {
+        for (iter = listeners.begin() ; iter != listeners.end() ; ){
             EventListenerEntry entry = *iter;
             if (entry.eventType == type &&
                 entry.listener  == listener &&
-                useCapture && entry.useCapture)
-                listeners.erase(iter);
+                useCapture && entry.useCapture){
+                iter = listeners.erase(iter);
+            }
+            else{
+                ++iter;
             }
         }
+    }
 
     /**
      * This method allows the dispatch of events into the implementation's event 
@@ -568,18 +571,21 @@ public:
                                        const DOMString &type,
                                        const EventListener *listener,
                                        bool useCapture)
-        {
+    {
         std::vector<EventListenerEntry>::iterator iter;
-        for (iter = listeners.begin() ; iter != listeners.end() ; ++iter)
-            {
+        for (iter = listeners.begin() ; iter != listeners.end() ; ){
             EventListenerEntry entry = *iter;
             if (entry.namespaceURI == namespaceURI &&
                 entry.eventType    == type &&
                 entry.listener     == listener &&
-                useCapture && entry.useCapture)
-                listeners.erase(iter);
+                useCapture && entry.useCapture){
+                iter = listeners.erase(iter);
+            }
+            else {
+                ++iter;
             }
         }
+    }
 
     /**
      * This method allows the DOM application to know if an event listener, attached 
diff --git a/src/dom/stylesheets.h b/src/dom/stylesheets.h
index 3ba225af3..fc1bc9d88 100644
--- a/src/dom/stylesheets.h
+++ b/src/dom/stylesheets.h
@@ -122,14 +122,17 @@ public:
      */
     virtual void deleteMedium(const DOMString& oldMedium)
                               throw (dom::DOMException)
-        {
+    {
         std::vector<DOMString>::iterator iter;
-        for (iter=items.begin() ; iter!=items.end() ; ++iter)
-            {
-            if (*iter == oldMedium)
-                items.erase(iter);
+        for (iter=items.begin() ; iter!=items.end() ; ){
+            if (*iter == oldMedium){
+                iter = items.erase(iter);
+            }
+            else{
+                ++iter;
             }
         }
+    }
 
     /**
      * Adds the medium newMedium to the end of the list. If the newMedium
diff --git a/src/ui/tool/path-manipulator.cpp b/src/ui/tool/path-manipulator.cpp
index 4be8df397..a7369f915 100644
--- a/src/ui/tool/path-manipulator.cpp
+++ b/src/ui/tool/path-manipulator.cpp
@@ -1006,7 +1006,7 @@ void PathManipulator::_createControlPointsFromGeometry()
         // When we erase an element, the next one slides into position,
         // so we do not increment the iterator even though it is theoretically invalidated.
         if (i->empty()) {
-            pathv.erase(i);
+            i = pathv.erase(i);
         } else {
             ++i;
         }