wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 772282 - Hold on to nodes when we delete them in nsEditor::MoveNode; r=ehsan

Browse Source
This commit is contained in:
Aryeh Gregor 2012-07-11 10:51:13 +03:00
parent a65acdc8c4
commit 11df0cc2ad
3 changed files with 32 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
editor/libeditor/base/crashtests/772282.html Normal file
View File

@ -0,0 +1,27 @@
<!DOCTYPE html>
<html>
<head>
<script>
function boom()
{
var root = document.documentElement;
while(root.firstChild) { root.removeChild(root.firstChild); }
var body = document.createElementNS("http://www.w3.org/1999/xhtml", "body");
body.setAttributeNS(null, "contenteditable", "true");
var img = document.createElementNS("http://www.w3.org/1999/xhtml", "img");
body.appendChild(img);
root.appendChild(body);
document.removeChild(root);
document.appendChild(root);
document.execCommand("insertText", false, "5");
document.execCommand("selectAll", false, null);
document.execCommand("insertParagraph", false, null);
document.execCommand("increasefontsize", false, null);
}
</script>
</head>
<body onload="boom();"></body>
</html>

1
editor/libeditor/base/crashtests/crashtests.list
View File

@ -16,3 +16,4 @@ load 766413.html
load 766845.xhtml
load 768765.html
needs-focus load 771749.html
load 772282.html

7
editor/libeditor/base/nsEditor.cpp
View File

@ -1730,10 +1730,11 @@ nsEditor::MoveNode(nsIDOMNode *aNode, nsIDOMNode *aParent, PRInt32 aOffset)
aOffset--; // this is because when we delete aNode, it will make the offsets after it off by one
}
// put aNode in new parent
res = DeleteNode(aNode);
// Hold a reference so aNode doesn't go away when we remove it (bug 772282)
nsCOMPtr<nsIDOMNode> node = aNode;
res = DeleteNode(node);
NS_ENSURE_SUCCESS(res, res);
return InsertNode(aNode, aParent, aOffset);
return InsertNode(node, aParent, aOffset);
}