Bug 559526 - Moving a NodeIterator from its NodeFilter causes a crash, r=sicking

--HG--
extra : rebase_source : fc22f797ae28009752075c21a280647f042c886c
This commit is contained in:
Olli Pettay 2010-04-16 21:45:13 +03:00
parent 5f7b8610fa
commit 79f6246f12
5 changed files with 109 additions and 4 deletions

View File

@ -301,7 +301,7 @@ nsNodeIterator::NextOrPrevNode(NodePointer::MoveToMethodType aMove,
*_retval = nsnull;
if (mDetached)
if (mDetached || mInAcceptNode)
return NS_ERROR_DOM_INVALID_STATE_ERR;
mWorkingPointer = mPointer;

View File

@ -54,7 +54,8 @@ nsTraversal::nsTraversal(nsINode *aRoot,
mRoot(aRoot),
mWhatToShow(aWhatToShow),
mFilter(aFilter),
mExpandEntityReferences(aExpandEntityReferences)
mExpandEntityReferences(aExpandEntityReferences),
mInAcceptNode(PR_FALSE)
{
NS_ASSERTION(aRoot, "invalid root in call to nsTraversal constructor");
}
@ -73,6 +74,8 @@ nsTraversal::~nsTraversal()
*/
nsresult nsTraversal::TestNode(nsINode* aNode, PRInt16* _filtered)
{
NS_ENSURE_TRUE(!mInAcceptNode, NS_ERROR_DOM_INVALID_STATE_ERR);
nsresult rv;
*_filtered = nsIDOMNodeFilter::FILTER_SKIP;
@ -114,7 +117,10 @@ nsresult nsTraversal::TestNode(nsINode* aNode, PRInt16* _filtered)
domNode = do_QueryInterface(aNode);
}
return mFilter->AcceptNode(domNode, _filtered);
mInAcceptNode = PR_TRUE;
rv = mFilter->AcceptNode(domNode, _filtered);
mInAcceptNode = PR_FALSE;
return rv;
}
*_filtered = nsIDOMNodeFilter::FILTER_ACCEPT;

View File

@ -62,7 +62,8 @@ protected:
nsCOMPtr<nsINode> mRoot;
PRUint32 mWhatToShow;
nsCOMPtr<nsIDOMNodeFilter> mFilter;
PRBool mExpandEntityReferences;
PRPackedBool mExpandEntityReferences;
PRPackedBool mInAcceptNode;
/*
* Tests if and how a node should be filtered. Uses mWhatToShow and

View File

@ -372,6 +372,7 @@ _TEST_FILES = test_bug5141.html \
test_bug558726.html \
test_bug557892.html \
file_bug557892.html \
test_bug559526.html \
$(NULL)
# This test fails on the Mac for some reason

View File

@ -0,0 +1,97 @@
<!DOCTYPE HTML>
<html>
<!--
https://bugzilla.mozilla.org/show_bug.cgi?id=559526
-->
<head>
<title>Test for Bug 559526</title>
<script type="application/javascript" src="/MochiKit/packed.js"></script>
<script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
</head>
<body>
<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=559526">Mozilla Bug 559526</a>
<p id="display"></p>
<div id="content" style="display: none">
</div>
<pre id="test">
<div id="nodes" style="display:none">
<div id="child1"></div>
<div id="child2"></div>
<div id="child3"></div>
<div id="child4"></div>
<div id="child5"></div>
<div id="child6"></div>
<div id="child7"></div>
<div id="child8"></div>
</div>
<script type="application/javascript">
/** Test for Bug 559526 **/
var it;
var recurse = false;
var testCount = 0;
function filter(node) {
if (node.id == "child3" && ! recurse) {
recurse = true;
var ex = null;
try {
var foo = it.nextNode();
} catch(e) {
ex = e;
}
++testCount;
is(ex.code, DOMException.INVALID_STATE_ERR, "Should have thrown an exception!");
recurse = false;
}
return NodeFilter.FILTER_ACCEPT;
}
(function testNodeIterator() {
it = document.createNodeIterator(
document.getElementById("nodes"),
NodeFilter.SHOW_ELEMENT,
filter,
false
);
while (it.nextNode());
})();
(function testTreeWalker() {
it = document.createTreeWalker(
document.getElementById("nodes"),
NodeFilter.SHOW_ELEMENT,
filter,
false
);
while(it.nextNode());
it = document.createTreeWalker(
document.getElementById("nodes"),
NodeFilter.SHOW_ELEMENT,
filter,
false
);
it.firstChild();
while(it.nextSibling());
it = document.createTreeWalker(
document.getElementById("nodes"),
NodeFilter.SHOW_ELEMENT,
filter,
false
);
it.lastChild();
while(it.previousSibling());
})();
is(testCount, 4, "Should have tests 3 filter calls!");
</script>
</pre>
</body>
</html>