wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 846096: Bail out of nsRange::ParentChainChanged if the nodes aren't in a connected subtree. r=smaug

Browse Source
This commit is contained in:
L. David Baron 2013-03-04 08:37:48 -08:00
parent 219d46c31f
commit ff59a827fa
1 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
content/base/src/nsRange.cpp
View File

@ -663,8 +663,19 @@ nsRange::ParentChainChanged(nsIContent *aContent)
NS_ASSERTION(mRoot == aContent, "Wrong ParentChainChanged notification?");
nsINode* newRoot = IsValidBoundary(mStartParent);
NS_ASSERTION(newRoot, "No valid boundary or root found!");
NS_ASSERTION(newRoot == IsValidBoundary(mEndParent),
"Start parent and end parent give different root!");
if (newRoot != IsValidBoundary(mEndParent)) {
// Sometimes ordering involved in cycle collection can lead to our
// start parent and/or end parent being disconnected from our root
// without our getting a ContentRemoved notification.
// See bug 846096 for more details.
NS_ASSERTION(mEndParent->IsInNativeAnonymousSubtree(),
"This special case should happen only with "
"native-anonymous content");
// When that happens, bail out and set pointers to null; since we're
// in cycle collection and unreachable it shouldn't matter.
Reset();
return;
}
// This is safe without holding a strong ref to self as long as the change
// of mRoot is the last thing in DoSetRange.
DoSetRange(mStartParent, mStartOffset, mEndParent, mEndOffset, newRoot);