Attachment 632615 Details for Bug 762183

[patch] Patch part 4, v2 -- Fix assertion in DeleteTextTxn::Init

patch (text/plain), 3.04 KB, created by Aryeh Gregor (:ayg) (no longer with Mozilla)

(hide)

Description:

Filename:

MIME Type:

Creator: Aryeh Gregor (:ayg) (no longer with Mozilla)

Size: 3.04 KB

patch

obsolete

># HG changeset patch
># User Aryeh Gregor <ayg@aryeh.name>
># Date 1339517127 -10800
># Node ID 235bfd4e97677817e67d8f7ca9edc9fc43630747
># Parent  61185911b73c9b06413530d78efbd7953a65a0af
>Bug 762183 part 4 - Fix assertion in DeleteTextTxn::Init
>
>diff --git a/editor/libeditor/base/crashtests/762183.html b/editor/libeditor/base/crashtests/762183.html
>new file mode 100644
>--- /dev/null
>+++ b/editor/libeditor/base/crashtests/762183.html
>@@ -0,0 +1,6 @@
>+<body contenteditable=true>x   y
>+<script>
>+document.body.firstChild.splitText(2).splitText(1).splitText(1);
>+getSelection().collapse(document.body, 1);
>+document.execCommand("forwardDelete", false, null);
>+</script>
>diff --git a/editor/libeditor/base/crashtests/crashtests.list b/editor/libeditor/base/crashtests/crashtests.list
>--- a/editor/libeditor/base/crashtests/crashtests.list
>+++ b/editor/libeditor/base/crashtests/crashtests.list
>@@ -5,8 +5,9 @@ load 407079-1.html
> load 407256-1.html
> load 430624-1.html
> load 459613.html
> load 475132-1.xhtml
> load 633709.xhtml
> load 636074-1.html
> load 713427-1.html
> load 713427-2.xhtml
>+load 762183.html
>diff --git a/editor/libeditor/base/nsEditor.cpp b/editor/libeditor/base/nsEditor.cpp
>--- a/editor/libeditor/base/nsEditor.cpp
>+++ b/editor/libeditor/base/nsEditor.cpp
>@@ -4762,16 +4762,19 @@ nsEditor::CreateTxnForDeleteCharacter(ns
>                                       PRUint32             aOffset,
>                                       EDirection           aDirection,
>                                       DeleteTextTxn**      aTxn)
> {
>   NS_ASSERTION(aDirection == eNext || aDirection == ePrevious,
>                "invalid direction");
>   nsAutoString data;
>   aData->GetData(data);
>+  NS_ASSERTION(data.Length(), "Trying to delete from a zero-length node");
>+  NS_ENSURE_STATE(data.Length());
>+
>   PRUint32 segOffset = aOffset, segLength = 1;
>   if (aDirection == eNext) {
>     if (segOffset + 1 < data.Length() &&
>         NS_IS_HIGH_SURROGATE(data[segOffset]) &&
>         NS_IS_LOW_SURROGATE(data[segOffset+1])) {
>       // delete both halves of the surrogate pair
>       ++segLength;
>     }
>@@ -4911,16 +4914,26 @@ nsEditor::CreateTxnForDeleteInsertionPoi
>     nsCOMPtr<nsINode> selectedNode;
>     if (aAction == ePrevious) {
>       selectedNode = GetPriorNode(node, offset, true);
>     } else if (aAction == eNext) {
>       selectedNode = GetNextNode(node, offset, true);
>     }
>     NS_ENSURE_STATE(selectedNode);
> 
>+    while (selectedNode->IsNodeOfType(nsINode::eDATA_NODE) &&
>+           !selectedNode->Length()) {
>+      // Can't delete an empty chardata node (bug 762183)
>+      if (aAction == ePrevious) {
>+        selectedNode = GetPriorNode(selectedNode, true);
>+      } else if (aAction == eNext) {
>+        selectedNode = GetNextNode(selectedNode, true);
>+      }
>+    }
>+
>     nsCOMPtr<nsIDOMCharacterData> selectedNodeAsText =
>       do_QueryInterface(selectedNode);
>     if (selectedNodeAsText) {
>       // we are deleting from a text node, so do a text deletion
>       PRUint32 position = 0;
>       if (aAction == ePrevious) {
>         position = selectedNode->Length();
>       }

Flags:

ehsan.akhgari: review+

Actions: View | Diff | Review

Attachments on bug 762183: 630661 | 630662 | 632269 | 632270 | 632273 | 632280 | 632614 | 632615 | 632617