wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 767169 part 2 - Handle lastCandidate being null in nsContentSubtreeIterator::Init; r=bz

Browse Source
This commit is contained in:
Aryeh Gregor 2012-06-28 14:29:56 +03:00
parent c36606e273
commit a0343acde5
3 changed files with 33 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
content/base/src/nsContentIterator.cpp
View File

@ -1268,12 +1268,12 @@ nsContentSubtreeIterator::Init(nsIDOMRange* aRange)
PRInt32 numChildren = endParent->GetChildCount();
if (offset > numChildren) {
// Can happen for text nodes -- or if we're being called from
// nsNodeUtils::ContentRemoved and the range hasn't been adjusted yet (bug
// 767169).
offset = numChildren;
}
if (!offset) {
node = endParent;
} else if (!numChildren) {
// no children, must be a text node
if (!offset || !numChildren) {
node = endParent;
} else {
lastCandidate = endParent->GetChildAt(--offset);
@ -1286,6 +1286,11 @@ nsContentSubtreeIterator::Init(nsIDOMRange* aRange)
lastCandidate = GetPrevSibling(node);
}
if (!lastCandidate) {
MakeEmpty();
return NS_OK;
}
lastCandidate = GetDeepLastChild(lastCandidate);
// confirm that this last possible contained node is indeed contained. Else

23
editor/libeditor/html/crashtests/767169.html Normal file
View File

@ -0,0 +1,23 @@
<html>
<head>
<script>
// Document must not have a doctype to trigger the bug
function boom()
{
var root = document.documentElement;
while (root.firstChild) { root.removeChild(root.firstChild); }
root.contentEditable = "true";
document.removeChild(root);
document.appendChild(root);
window.getSelection().collapse(root, 0);
window.getSelection().extend(document, 1);
document.removeChild(root);
}
</script>
</head>
<body onload="boom();"></body>
</html>

1
editor/libeditor/html/crashtests/crashtests.list
View File

@ -32,3 +32,4 @@ load 769008-1.html
load 766305.html
load 766387.html
load 766795.html
load 767169.html