Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-28 23:31:56 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 515829. Don't assume that mDefaultSubmitElement is non-null just because our firstSubmitSlot contains non-null. r=jst

Browse Source
This commit is contained in:
Boris Zbarsky 2009-09-18 14:52:36 -04:00
parent b21d390674
commit 0d41491006
4 changed files with 26 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
content/html/content/crashtests/515829-1.html Normal file
View File

@ -0,0 +1,7 @@
<!DOCTYPE html>
<html>
<head></head>
<body onload="document.getElementById('x').innerHTML = '<button></button>';">
<form><div id="x"><button></button></div><button></button></form>
</body>
</html>

7
content/html/content/crashtests/515829-2.html Normal file
View File

@ -0,0 +1,7 @@
<!DOCTYPE html>
<html>
<head></head>
<body onload="document.getElementById('x').innerHTML = '<button></button>';">
<form><div id="x"><button></button></div><button></button><input type="image"></form>
</body>
</html>

2
content/html/content/crashtests/crashtests.list
View File

@ -10,3 +10,5 @@ load 423371-1.html
load 451123-1.html
load 453406-1.html
load 504183-1.html
load 515829-1.html
load 515829-2.html

18
content/html/content/src/nsHTMLFormElement.cpp
View File

@ -1433,19 +1433,21 @@ nsHTMLFormElement::AddElement(nsIFormControl* aChild,
if (!*firstSubmitSlot ||
(!lastElement &&
CompareFormControlPosition(aChild, *firstSubmitSlot, this) < 0)) {
NS_ASSERTION(*firstSubmitSlot == mDefaultSubmitElement ||
mDefaultSubmitElement,
"How can we have a null mDefaultSubmitElement but a "
"first-submit slot in one of the lists?");
if (*firstSubmitSlot == mDefaultSubmitElement ||
CompareFormControlPosition(aChild,
mDefaultSubmitElement, this) < 0) {
// Update mDefaultSubmitElement if it's currently in a valid state.
// Valid state means either non-null or null because there are in fact
// no submit elements around.
if ((mDefaultSubmitElement ||
(!mFirstSubmitInElements && !mFirstSubmitNotInElements)) &&
(*firstSubmitSlot == mDefaultSubmitElement ||
CompareFormControlPosition(aChild,
mDefaultSubmitElement, this) < 0)) {
mDefaultSubmitElement = aChild;
}
*firstSubmitSlot = aChild;
}
NS_POSTCONDITION(mDefaultSubmitElement == mFirstSubmitInElements ||
mDefaultSubmitElement == mFirstSubmitNotInElements,
mDefaultSubmitElement == mFirstSubmitNotInElements ||
!mDefaultSubmitElement,
"What happened here?");
// Notify that the state of the previous default submit element has changed