Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-01-08 12:22:34 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1408170 - Set child correctly in HTMLEditRules::GetPromotedPoint(); r=masayuki

Browse Source
This commit is contained in:
Ehsan Akhgari 2017-10-12 23:29:51 -04:00
parent 1148a3f366
commit 1349bede70
3 changed files with 22 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
editor/libeditor/HTMLEditRules.cpp
View File

@ -5572,7 +5572,7 @@ HTMLEditRules::GetPromotedPoint(RulesEndpoint aWhere,
!htmlEditor->IsVisibleBRElement(priorNode) &&
!IsBlockNode(*priorNode)) {
offset = priorNode->GetParentNode()->IndexOf(priorNode);
child = node;
child = priorNode;
node = priorNode->GetParentNode();
priorNode = htmlEditor->GetPriorHTMLNode(node, offset, child, true);
}

20
editor/libeditor/crashtests/1408170.html Normal file
View File

@ -0,0 +1,20 @@
<script>
function jsfuzzer() {
try { document.execCommand("insertUnorderedList", false); } catch(e) { }
try { document.execCommand("delete", false); } catch(e) { }
}
function eventhandler1() {
try { window.getSelection().collapse(htmlvar00001,1); } catch(e) { }
}
function eventhandler2() {
try { htmlvar00002.appendChild(htmlvar00001); } catch(e) { }
}
</script>
<body onload=jsfuzzer()>
<label id="htmlvar00002" contenteditable="true">
<details ontoggle="eventhandler2()" open="true">
</details>
</label>
<details ontoggle="eventhandler1()" open="true">
<font id="htmlvar00001" dir="rtl">
<summary>

1
editor/libeditor/crashtests/crashtests.list
View File

@ -90,3 +90,4 @@ load 1393171.html
load 1402469.html
load 1402904.html
load 1405747.html
load 1408170.html