Attachment 630496 Details for Bug 761861

[patch] Patch v2, with test

patch (text/plain), 2.30 KB, created by Aryeh Gregor (:ayg) (no longer with Mozilla)

(hide)

Description:

Filename:

MIME Type:

Creator: Aryeh Gregor (:ayg) (no longer with Mozilla)

Size: 2.30 KB

patch

obsolete

># HG changeset patch
># User Aryeh Gregor <ayg@aryeh.name>
># Date 1338979838 -10800
># Node ID a3df92471f35a28847d8a73806ba49f11a03c972
># Parent  daead2fdd38a6d2770721b890388ef37b3ef3859
>Bug 761861 - Fix crash in nsHTMLEditor::DeleteSelectionImpl
>
>diff --git a/editor/libeditor/html/crashtests/761861.html b/editor/libeditor/html/crashtests/761861.html
>new file mode 100644
>--- /dev/null
>+++ b/editor/libeditor/html/crashtests/761861.html
>@@ -0,0 +1,15 @@
>+<!doctype html>
>+<script>
>+function boom() {
>+  var r = document.documentElement;
>+  while (r.firstChild) {
>+    r.removeChild(r.firstChild);
>+  }
>+
>+  document.documentElement.contentEditable = "true";
>+  document.execCommand("forecolor", false, "green");
>+  document.execCommand("insertParagraph", false, "_");
>+  document.execCommand("forwardDelete");
>+}
>+</script>
>+<body onload="boom()">
>diff --git a/editor/libeditor/html/crashtests/crashtests.list b/editor/libeditor/html/crashtests/crashtests.list
>--- a/editor/libeditor/html/crashtests/crashtests.list
>+++ b/editor/libeditor/html/crashtests/crashtests.list
>@@ -22,8 +22,9 @@ load 582138-1.xhtml
> load 612565-1.html
> asserts(0-6) load 615015-1.html # Bug 439258
> load 615450-1.html
> load 639736-1.xhtml
> load 643786-1.html
> load 682650-1.html
> load 716456-1.html
> load 759748.html
>+load 761861.html
>diff --git a/editor/libeditor/html/nsHTMLEditor.cpp b/editor/libeditor/html/nsHTMLEditor.cpp
>--- a/editor/libeditor/html/nsHTMLEditor.cpp
>+++ b/editor/libeditor/html/nsHTMLEditor.cpp
>@@ -3397,19 +3397,22 @@ nsHTMLEditor::DeleteSelectionImpl(EDirec
>   NS_ENSURE_STATE(typedSel->GetAnchorFocusRange()->Collapsed());
> 
>   nsCOMPtr<nsIContent> content = do_QueryInterface(typedSel->GetAnchorNode());
>   NS_ENSURE_STATE(content);
> 
>   // Don't strip wrappers if this is the only wrapper in the block.  Then we'll
>   // add a <br> later, so it won't be an empty wrapper in the end.
>   nsCOMPtr<nsIContent> blockParent = content;
>-  while (!IsBlockNode(blockParent)) {
>+  while (blockParent && !IsBlockNode(blockParent)) {
>     blockParent = blockParent->GetParent();
>   }
>+  if (!blockParent) {
>+    return NS_OK;
>+  }
>   bool emptyBlockParent;
>   res = IsEmptyNode(blockParent, &emptyBlockParent);
>   NS_ENSURE_SUCCESS(res, res);
>   if (emptyBlockParent) {
>     return NS_OK;
>   }
> 
>   if (content && !IsBlockNode(content) && !content->Length() &&

Actions: View | Diff | Review

Attachments on bug 761861: 630374 | 630375 | 630480 | 630496 | 630503