Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-28 07:13:20 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1672856 - Don't crash when printing with selections pointing to detached nodes. r=jfkthame

Browse Source 
In some edge cases involving shadow dom the selection code may get
confused and keep references to inside the shadow root (of <audio> in
this case).

Avoid crashing due to that in the printing code for now, bug.

Bug 1590379 tracks issues with selection handling inside shadow DOM.

Differential Revision: https://phabricator.services.mozilla.com/D94578
This commit is contained in:
Emilio Cobos Álvarez 2020-10-23 11:01:14 +00:00
parent 269dca3881
commit 077cdbdfc5
2 changed files with 24 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
dom/base/Document.cpp
View File

@ -12325,6 +12325,12 @@ static nsINode* GetCorrespondingNodeInDocument(const nsINode* aOrigNode,
return nullptr;
}
// If the node is disconnected, this is a bug in the selection code, but it
// can happen with shadow DOM so handle it.
if (NS_WARN_IF(!aOrigNode->IsInComposedDoc())) {
return nullptr;
}
nsTArray<int32_t> indexArray;
const nsINode* current = aOrigNode;
while (const nsINode* parent = current->GetParentNode()) {

18
testing/web-platform/tests/selection/selection-shadow-dom-crash-print.html Normal file
View File

@ -0,0 +1,18 @@
<!doctype html>
<title>Printing with odd selections doesn't crash</title>
<!-- Really a crashtest but since we can't really have print crashtests, we assert that we print something -->
<link rel="mismatch" href="/css/reference/blank.html">
<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1672856">
<script>
function go() {
var x = document.getSelection()
x.extend(b)
x.modify("move", "left", "word")
a.remove()
}
</script>
<body onload=go()>
<audio id="a" controls="">
<progress contentEditable>
</audio>
<li id="b">x</li>