mirror of
https://gitlab.winehq.org/wine/wine-gecko.git
synced 2024-09-13 09:24:08 -07:00
bug 403841 - Crash in nsContentUtils::CreateContextualFragment when passed a non-element node as context node. r+sr=sicking
This commit is contained in:
parent
4160214e4c
commit
9efc20152c
@ -3219,6 +3219,10 @@ nsContentUtils::CreateContextualFragment(nsIDOMNode* aContextNode,
|
||||
nsAutoTArray<nsAutoString, 32> tagStack;
|
||||
nsAutoString uriStr, nameStr;
|
||||
|
||||
// just in case we have a text node
|
||||
if (!content->IsNodeOfType(nsINode::eELEMENT))
|
||||
content = content->GetParent();
|
||||
|
||||
while (content && content->IsNodeOfType(nsINode::eELEMENT)) {
|
||||
nsAutoString& tagName = *tagStack.AppendElement();
|
||||
NS_ENSURE_TRUE(&tagName, NS_ERROR_OUT_OF_MEMORY);
|
||||
|
@ -113,6 +113,7 @@ _TEST_FILES = test_bug5141.html \
|
||||
test_bug402150.html \
|
||||
test_bug402150.html^headers^ \
|
||||
test_bug401662.html \
|
||||
test_bug403841.html \
|
||||
$(NULL)
|
||||
|
||||
libs:: $(_TEST_FILES)
|
||||
|
30
content/base/test/test_bug403841.html
Normal file
30
content/base/test/test_bug403841.html
Normal file
@ -0,0 +1,30 @@
|
||||
<!DOCTYPE HTML>
|
||||
<html>
|
||||
<!--
|
||||
https://bugzilla.mozilla.org/show_bug.cgi?id=403841
|
||||
-->
|
||||
<head>
|
||||
<title>Test for Bug 403841</title>
|
||||
<script type="text/javascript" src="/MochiKit/MochiKit.js"></script>
|
||||
<script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
|
||||
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
|
||||
</head>
|
||||
<body>
|
||||
<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=403841">Mozilla Bug 403841</a>
|
||||
<span id="content">abc</p>
|
||||
<pre id="test">
|
||||
<script class="testbody" type="text/javascript">
|
||||
|
||||
/** Test for Bug 403841 - Crash in nsContentUtils::CreateContextualFragment when passed a non-element node as context node **/
|
||||
var t = document.getElementById("content").firstChild;
|
||||
var r = document.createRange();
|
||||
r.setStart(t,0);
|
||||
r.setEnd(t,3);
|
||||
// make sure this doesn't crash
|
||||
var f = r.createContextualFragment("<span>");
|
||||
ok(f.firstChild instanceof HTMLSpanElement, "created fragment ok");
|
||||
</script>
|
||||
</pre>
|
||||
</body>
|
||||
</html>
|
||||
|
Loading…
Reference in New Issue
Block a user