wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 766413 - Fix crash in nsEditor::CreateTxnForDeleteInsertionPoint; r=ehsan on a CLOSED TREE

Browse Source
This commit is contained in:
Aryeh Gregor 2012-06-20 15:48:02 +01:00
parent 1e22410675
commit 78c9af52bc
3 changed files with 46 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
editor/libeditor/base/crashtests/766413.html Normal file
View File

@ -0,0 +1,42 @@
<!DOCTYPE html>
<html>
<head>
<script>
function boom()
{
var root = document.documentElement;
while (root.firstChild) {
root.removeChild(root.firstChild);
}
var space = document.createTextNode(" ");
var body = document.createElementNS("http://www.w3.org/1999/xhtml", "body");
root.contentEditable = "true";
root.focus();
document.execCommand("contentReadOnly", false, null);
root.appendChild(body);
root.contentEditable = "false";
root.appendChild(space);
root.removeChild(body);
root.contentEditable = "true";
window.getSelection().removeAllRanges();
var r1 = document.createRange();
r1.setStart(root, 0);
r1.setEnd(root, 0);
window.getSelection().addRange(r1);
looseText = document.createTextNode("c");
var r2 = document.createRange();
r2.setStart(looseText, 0);
r2.setEnd(looseText, 0);
window.getSelection().addRange(r2);
document.execCommand("forwardDelete", false, null);
}
</script>
</head>
<body onload="boom();"></body>
</html>

1
editor/libeditor/base/crashtests/crashtests.list
View File

@ -11,3 +11,4 @@ load 636074-1.html
load 713427-1.html
load 713427-2.xhtml
load 762183.html
load 766413.html

5
editor/libeditor/base/nsEditor.cpp
View File

@ -4919,9 +4919,9 @@ nsEditor::CreateTxnForDeleteInsertionPoint(nsRange* aRange,
} else if (aAction == eNext) {
selectedNode = GetNextNode(node, offset, true);
}
NS_ENSURE_STATE(selectedNode);
while (selectedNode->IsNodeOfType(nsINode::eDATA_NODE) &&
while (selectedNode &&
selectedNode->IsNodeOfType(nsINode::eDATA_NODE) &&
!selectedNode->Length()) {
// Can't delete an empty chardata node (bug 762183)
if (aAction == ePrevious) {
@ -4930,6 +4930,7 @@ nsEditor::CreateTxnForDeleteInsertionPoint(nsRange* aRange,
selectedNode = GetNextNode(selectedNode, true);
}
}
NS_ENSURE_STATE(selectedNode);
nsCOMPtr<nsIDOMCharacterData> selectedNodeAsCharData =
do_QueryInterface(selectedNode);