wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 776323 part 1 - Fix crash due to silly logic error in nsSelectionState::SaveSelection; r=ehsan

Browse Source
This commit is contained in:
Aryeh Gregor 2012-07-23 13:27:22 +03:00
parent f35c6c9667
commit a80cb9b3a2
3 changed files with 20 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
editor/libeditor/base/crashtests/776323.html Normal file
View File

@ -0,0 +1,18 @@
<!DOCTYPE html>
<html contenteditable="true">
<head>
<script>
function boom()
{
document.execCommand("inserthtml", false, "b");
var myrange = document.createRange();
myrange.selectNodeContents(document.getElementsByTagName("img")[0]);
window.getSelection().addRange(myrange);
document.execCommand("strikethrough", false, null);
}
</script>
</head>
<body onload="boom();"><img></body>
</html>

1
editor/libeditor/base/crashtests/crashtests.list
View File

@ -17,3 +17,4 @@ load 766845.xhtml
load 768765.html load 768765.html
needs-focus load 771749.html needs-focus load 771749.html
load 772282.html load 772282.html
load 776323.html

4
editor/libeditor/base/nsSelectionState.cpp
View File

@ -57,9 +57,7 @@ nsSelectionState::SaveSelection(nsISelection *aSel)
// if we need more items in the array, new them // if we need more items in the array, new them
if (arrayCount<rangeCount) if (arrayCount<rangeCount)
{ {
PRInt32 count = rangeCount-arrayCount; for (i = arrayCount; i < rangeCount; i++) {
for (i=0; i<count; i++)
{
mArray.AppendElement(); mArray.AppendElement();
mArray[i] = new nsRangeStore(); mArray[i] = new nsRangeStore();
} }