Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-25 22:01:30 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Call EnsureTextRun() and null-check GetTextRun() return value before using it. b=560780 r=roc

Browse Source
This commit is contained in:
Mats Palmgren 2010-04-28 19:47:23 +02:00
parent db44c31d90
commit 2abd2f4052
3 changed files with 108 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
content/base/src/nsRange.cpp
View File

@ -2071,18 +2071,20 @@ static nsresult GetPartialTextRect(nsLayoutUtils::RectCallback* aCallback,
nsIFrame* relativeTo = nsLayoutUtils::GetContainingBlockForClientRect(textFrame);
for (nsTextFrame* f = textFrame; f; f = static_cast<nsTextFrame*>(f->GetNextContinuation())) {
PRInt32 fstart = f->GetContentOffset(), fend = f->GetContentEnd();
PRBool rtl = f->GetTextRun()->IsRightToLeft();
if (fend <= aStartOffset || fstart >= aEndOffset)
continue;
//overlaping with the offset we want
// overlapping with the offset we want
f->EnsureTextRun();
NS_ENSURE_TRUE(f->GetTextRun(), NS_ERROR_OUT_OF_MEMORY);
PRBool rtl = f->GetTextRun()->IsRightToLeft();
nsRect r(f->GetOffsetTo(relativeTo), f->GetSize());
if (fstart < aStartOffset) {
//aStartOffset is within this frame
// aStartOffset is within this frame
ExtractRectFromOffset(f, relativeTo, aStartOffset, &r, rtl);
}
if (fend > aEndOffset) {
//aEndOffset is in the middle of this frame
// aEndOffset is in the middle of this frame
ExtractRectFromOffset(f, relativeTo, aEndOffset, &r, !rtl);
}
aCallback->AddRect(r);

3
content/base/test/Makefile.in
View File

@ -378,7 +378,8 @@ _TEST_FILES = test_bug5141.html \
file_csp_redirects_page.sjs \
file_csp_redirects_main.html \
file_csp_redirects_resource.sjs \
test_bug346485.html \
test_bug346485.html \
test_bug560780.html \
$(NULL)
# This test fails on the Mac for some reason

100
content/base/test/test_bug560780.html Normal file
View File

@ -0,0 +1,100 @@
<!DOCTYPE HTML>
<html>
<!--
https://bugzilla.mozilla.org/show_bug.cgi?id=560780
-->
<head>
<title>Test for Bug 560780</title>
<script type="application/javascript" src="/MochiKit/packed.js"></script>
<script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
<script type="application/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
<script type="text/javascript">
function init() {
var elem = document.getElementById('body');
elem.addEventListener('mousedown', mousedown, true);
}
var seen_mousedown = 0;
function mousedown(event) {
var doc = event.target.ownerDocument;
var win = doc.defaultView;
var elem = doc.getElementById('body');
var selection = win.getSelection();
if (selection.rangeCount>0) {
var ragne = selection.getRangeAt(0);
var rect = ragne.getBoundingClientRect();
var p = elem.parentNode.appendChild(doc.createElement('p'));
p.textContent = "width: " + (rect.right -rect.left);
}
++seen_mousedown;
}
</script>
</head>
<body id="body">
<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=560780">Mozilla Bug 560780</a>
<p id="display" style="margin:0;padding:0;border:0"><a id="testlink" href="#aaaaaaaaaaaaaaaaaaaaaa">abcdefghijklmnabcdefghijklmn</a></p>
<div id="content" style="display: none">
</div>
<pre id="test">
1.Start Minefield with New Profile.
2.Select texts by alt + mouse dragging horizontaly from 'd' in the link above to far right of window.
3.Click on the selected text
4.Click empty area of page
5.Repeat STEP 2 to 4 till browser crashes. (at least 5 times)
<script type="application/javascript">
/** Test for Bug 560780 **/
function selectByMouseThenClick(elm,startx,starty) {
// select some text
var ctrl = navigator.platform.indexOf("Linux") ? true : false;
var alt = true;
var x = startx;
synthesizeMouse(elm, x, starty, { type:"mousedown", ctrlKey:ctrl, altKey:alt });
synthesizeMouse(elm, x += 100, starty, { type:"mousemove", ctrlKey:ctrl, altKey:alt });
synthesizeMouse(elm, x += 100, starty, { type:"mousemove", ctrlKey:ctrl, altKey:alt });
synthesizeMouse(elm, x += 100, starty, { type:"mousemove", ctrlKey:ctrl, altKey:alt });
synthesizeMouse(elm, x += 100, starty, { type:"mousemove", ctrlKey:ctrl, altKey:alt });
synthesizeMouse(elm, x += 100, starty, { type:"mousemove", ctrlKey:ctrl, altKey:alt });
synthesizeMouse(elm, x += 100, starty, { type:"mousemove", ctrlKey:ctrl, altKey:alt });
synthesizeMouse(elm, x += 100, starty, { type:"mousemove", ctrlKey:ctrl, altKey:alt });
synthesizeMouse(elm, x += 100, starty, { type:"mousemove", ctrlKey:ctrl, altKey:alt });
synthesizeMouse(elm, x, starty, { type:"mouseup", ctrlKey:ctrl, altKey:alt });
// click on the selection
synthesizeMouse(elm, startx + 10, starty + 1, {});
// click empty area of the page
synthesizeMouse(document.getElementById('body'), 800, 800, {});
}
function runTest() {
var e = document.getElementById('testlink');
selectByMouseThenClick(e,110,5);
selectByMouseThenClick(e,90,5);
selectByMouseThenClick(e,70,5);
selectByMouseThenClick(e,50,5);
selectByMouseThenClick(e,30,5);
selectByMouseThenClick(e,10,5);
is(seen_mousedown, 12, "got the mousedown events");
SimpleTest.finish();
}
function doTest() {
init();
runTest();
}
SimpleTest.waitForFocus(doTest, window);
SimpleTest.waitForExplicitFinish();
</script>
</pre>
</body>
</html>