wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 636074 - Part 1: Forget the transaction pointer when creating transaction objects in order to pass it to the caller instead of swapping it with random values; r=roc a=blocking-final+

Browse Source
This commit is contained in:
Ehsan Akhgari 2011-02-23 14:22:07 -08:00
parent c5197f8eeb
commit bcb0f84a06
3 changed files with 32 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
editor/libeditor/base/crashtests/636074-1.html Normal file
View File

@ -0,0 +1,18 @@
<!DOCTYPE html>
<html>
<head>
<script>
function boom()
{
document.getElementById("i").focus();
document.documentElement.contentEditable = "true";
document.execCommand("inserthtml", false, "<table>");
document.execCommand("indent", false, null);
document.execCommand("delete", false, null);
}
</script>
</head>
<body onload="boom();"><input id="i"></body>
</html>

1
editor/libeditor/base/crashtests/crashtests.list
View File

@ -7,3 +7,4 @@ load 430624-1.html
load 459613.html
load 475132-1.xhtml
load 633709.xhtml
load 636074-1.html

26
editor/libeditor/base/nsEditor.cpp
View File

@ -2661,7 +2661,7 @@ NS_IMETHODIMP nsEditor::CreateTxnForInsertText(const nsAString & aStringToInsert
rv = txn->Init(aTextNode, aOffset, aStringToInsert, this);
if (NS_SUCCEEDED(rv))
{
txn.swap(*aTxn);
txn.forget(aTxn);
}
return rv;
@ -2705,7 +2705,7 @@ NS_IMETHODIMP nsEditor::CreateTxnForDeleteText(nsIDOMCharacterData *aElement,
nsresult rv = txn->Init(this, aElement, aOffset, aLength, &mRangeUpdater);
if (NS_SUCCEEDED(rv))
{
txn.swap(*aTxn);
txn.forget(aTxn);
}
return rv;
@ -2725,7 +2725,7 @@ NS_IMETHODIMP nsEditor::CreateTxnForSplitNode(nsIDOMNode *aNode,
nsresult rv = txn->Init(this, aNode, aOffset);
if (NS_SUCCEEDED(rv))
{
txn.swap(*aTxn);
txn.forget(aTxn);
}
return rv;
@ -2742,7 +2742,7 @@ NS_IMETHODIMP nsEditor::CreateTxnForJoinNode(nsIDOMNode *aLeftNode,
nsresult rv = txn->Init(this, aLeftNode, aRightNode);
if (NS_SUCCEEDED(rv))
{
txn.swap(*aTxn);
txn.forget(aTxn);
}
return rv;
@ -4532,7 +4532,7 @@ nsEditor::CreateTxnForSetAttribute(nsIDOMElement *aElement,
nsresult rv = txn->Init(this, aElement, aAttribute, aValue, PR_FALSE);
if (NS_SUCCEEDED(rv))
{
txn.swap(*aTxn);
txn.forget(aTxn);
}
return rv;
@ -4551,7 +4551,7 @@ nsEditor::CreateTxnForRemoveAttribute(nsIDOMElement *aElement,
nsresult rv = txn->Init(this, aElement, aAttribute, EmptyString(), PR_TRUE);
if (NS_SUCCEEDED(rv))
{
txn.swap(*aTxn);
txn.forget(aTxn);
}
return rv;
@ -4570,7 +4570,7 @@ NS_IMETHODIMP nsEditor::CreateTxnForCreateElement(const nsAString& aTag,
nsresult rv = txn->Init(this, aTag, aParent, aPosition);
if (NS_SUCCEEDED(rv))
{
txn.swap(*aTxn);
txn.forget(aTxn);
}
return rv;
@ -4589,7 +4589,7 @@ NS_IMETHODIMP nsEditor::CreateTxnForInsertElement(nsIDOMNode * aNode,
nsresult rv = txn->Init(aNode, aParent, aPosition, this);
if (NS_SUCCEEDED(rv))
{
txn.swap(*aTxn);
txn.forget(aTxn);
}
return rv;
@ -4605,7 +4605,7 @@ NS_IMETHODIMP nsEditor::CreateTxnForDeleteElement(nsIDOMNode * aElement,
nsresult rv = txn->Init(this, aElement, &mRangeUpdater);
if (NS_SUCCEEDED(rv))
{
txn.swap(*aTxn);
txn.forget(aTxn);
}
return rv;
@ -4623,7 +4623,7 @@ nsEditor::CreateTxnForIMEText(const nsAString& aStringToInsert,
mIMETextRangeList, aStringToInsert, mSelConWeak);
if (NS_SUCCEEDED(rv))
{
txn.swap(*aTxn);
txn.forget(aTxn);
}
return rv;
@ -4638,7 +4638,7 @@ nsEditor::CreateTxnForAddStyleSheet(nsCSSStyleSheet* aSheet, AddStyleSheetTxn* *
nsresult rv = txn->Init(this, aSheet);
if (NS_SUCCEEDED(rv))
{
txn.swap(*aTxn);
txn.forget(aTxn);
}
return rv;
@ -4654,7 +4654,7 @@ nsEditor::CreateTxnForRemoveStyleSheet(nsCSSStyleSheet* aSheet, RemoveStyleSheet
nsresult rv = txn->Init(this, aSheet);
if (NS_SUCCEEDED(rv))
{
txn.swap(*aTxn);
txn.forget(aTxn);
}
return rv;
@ -4727,7 +4727,7 @@ nsEditor::CreateTxnForDeleteSelection(nsIEditor::EDirection aAction,
// we let the aggregation txn be destroyed when the refptr goes out of scope
if (NS_SUCCEEDED(result))
{
aggTxn.swap(*aTxn);
aggTxn.forget(aTxn);
}
return result;