wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 444030, Crash [@ nsGenericDOMDataNode::FirstLogicallyAdjacentTextNode] r+sr=jst

Browse Source
This commit is contained in:
Olli Pettay 2008-07-10 21:21:31 +03:00
parent 4f27d29ed8
commit 67170fb8db
4 changed files with 86 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
content/base/src/nsGenericDOMDataNode.cpp
View File

@ -992,9 +992,9 @@ nsText3Tearoff::ReplaceWholeText(const nsAString& aContent,
// Implementation of the nsIDOM3Text interface
/* static */ PRUint32
/* static */ PRInt32
nsGenericDOMDataNode::FirstLogicallyAdjacentTextNode(nsIContent* aParent,
PRUint32 aIndex)
PRInt32 aIndex)
{
while (aIndex-- > 0) {
nsIContent* sibling = aParent->GetChildAt(aIndex);
@ -1004,12 +1004,12 @@ nsGenericDOMDataNode::FirstLogicallyAdjacentTextNode(nsIContent* aParent,
return 0;
}
/* static */ PRUint32
/* static */ PRInt32
nsGenericDOMDataNode::LastLogicallyAdjacentTextNode(nsIContent* aParent,
PRUint32 aIndex,
PRInt32 aIndex,
PRUint32 aCount)
{
while (++aIndex < aCount) {
while (++aIndex < PRInt32(aCount)) {
nsIContent* sibling = aParent->GetChildAt(aIndex);
if (!sibling->IsNodeOfType(nsINode::eTEXT))
return aIndex - 1;
@ -1026,10 +1026,14 @@ nsGenericDOMDataNode::GetWholeText(nsAString& aWholeText)
if (!parent)
return GetData(aWholeText);
PRUint32 index = parent->IndexOf(this);
PRUint32 first =
PRInt32 index = parent->IndexOf(this);
NS_WARN_IF_FALSE(index >= 0,
"Trying to use .wholeText with an anonymous"
"text node child of a binding parent?");
NS_ENSURE_TRUE(index >= 0, NS_ERROR_DOM_NOT_SUPPORTED_ERR);
PRInt32 first =
FirstLogicallyAdjacentTextNode(parent, index);
PRUint32 last =
PRInt32 last =
LastLogicallyAdjacentTextNode(parent, index, parent->GetChildCount());
aWholeText.Truncate();
@ -1066,14 +1070,18 @@ nsGenericDOMDataNode::ReplaceWholeText(const nsAFlatString& aContent,
return CallQueryInterface(this, aReturn);
}
PRInt32 index = parent->IndexOf(this);
NS_WARN_IF_FALSE(index >= 0,
"Trying to use .replaceWholeText with an anonymous"
"text node child of a binding parent?");
NS_ENSURE_TRUE(index >= 0, NS_ERROR_DOM_NOT_SUPPORTED_ERR);
// We don't support entity references or read-only nodes, so remove the
// logically adjacent text nodes (which therefore must all be siblings of
// this) and set this one to the provided text, if that text isn't empty.
PRUint32 index = parent->IndexOf(this);
PRUint32 first =
PRInt32 first =
FirstLogicallyAdjacentTextNode(parent, index);
PRUint32 last =
PRInt32 last =
LastLogicallyAdjacentTextNode(parent, index, parent->GetChildCount());
do {

10
content/base/src/nsGenericDOMDataNode.h
View File

@ -313,12 +313,12 @@ protected:
friend class nsText3Tearoff;
static PRUint32 FirstLogicallyAdjacentTextNode(nsIContent* aParent,
PRUint32 aIndex);
static PRInt32 FirstLogicallyAdjacentTextNode(nsIContent* aParent,
PRInt32 aIndex);
static PRUint32 LastLogicallyAdjacentTextNode(nsIContent* aParent,
PRUint32 aIndex,
PRUint32 aCount);
static PRInt32 LastLogicallyAdjacentTextNode(nsIContent* aParent,
PRInt32 aIndex,
PRUint32 aCount);
nsresult GetWholeText(nsAString& aWholeText);

1
content/base/test/Makefile.in
View File

@ -183,6 +183,7 @@ _TEST_FILES = test_bug5141.html \
test_text_replaceWholeText.html \
test_text_wholeText.html \
wholeTexty-helper.xml \
test_bug444030.xhtml \
$(NULL)
libs:: $(_TEST_FILES)

60
content/base/test/test_bug444030.xhtml Normal file
View File

@ -0,0 +1,60 @@
<?xml version="1.0"?>
<html xmlns="http://www.w3.org/1999/xhtml">
<!--
https://bugzilla.mozilla.org/show_bug.cgi?id=444030
-->
<head>
<title>Test for Bug 444030</title>
<script type="text/javascript" src="/MochiKit/packed.js"></script>
<script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
<bindings xmlns="http://www.mozilla.org/xbl">
<binding id="e">
<content>e</content>
</binding>
</bindings>
</head>
<body>
<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=444030">Mozilla Bug 444030</a>
<p id="display"></p>
<div id="content" style="display: none">
</div>
<pre id="test">
<script class="testbody" type="text/javascript">
<![CDATA[
/** Test for Bug 444030 **/
function doTest() {
var anonTextNode = document.getAnonymousNodes(document.getElementById("boundElement"))[0];
var hadException = false;
try {
var wholeText = anonTextNode.wholeText;
} catch(e) {
hadException = true;
}
ok(hadException,
"Should have got an exception when using .wholeText with a text node child of the binding parent");
hadException = false;
try {
anonTextNode.replaceWholeText("foobar");
} catch(e) {
hadException = true;
}
ok(hadException,
"Should have got an exception when using .replaceWholeText with a text node child of the binding parent");
SimpleTest.finish();
}
SimpleTest.waitForExplicitFinish();
addLoadEvent(doTest);
]]>
</script>
</pre>
<div style="-moz-binding: url(#e)" id="boundElement"></div>
</body>
</html>