Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-24 13:21:05 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 981279 - Clear the attribute holder after parsing innerHTML. r=smaug

Browse Source
This commit is contained in:
Henri Sivonen 2014-03-10 11:14:16 +02:00
parent 6cca32afef
commit 4d398a8a1d
4 changed files with 22 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
parser/html/javasrc/Tokenizer.java
View File

@ -6595,11 +6595,12 @@ public class Tokenizer implements Locator {
attributeName = null;
}
tokenHandler.endTokenization();
// [NOCPP[
if (attributes != null) {
// [NOCPP[
attributes = null;
// ]NOCPP]
// CPPONLY: attributes.clear(mappingLangToXmlLang);
}
// ]NOCPP]
}
public void requestSuspension() {

3
parser/html/nsHtml5Tokenizer.cpp
View File

@ -3936,6 +3936,9 @@ nsHtml5Tokenizer::end()
attributeName = nullptr;
}
tokenHandler->endTokenization();
if (attributes) {
attributes->clear(0);
}
}
void

15
parser/htmlparser/tests/crashtests/981279-1.html Normal file
View File

@ -0,0 +1,15 @@
<!DOCTYPE html>
<html>
<head>
<meta charset=utf-8>
</head>
<body>
<div></div>
<script>
var div = document.getElementsByTagName("div")[0];
div.innerHTML = "<div À Á Â Ã Ä Å ";
div.innerHTML = "<div a>";
</script>
</body>
</html>

1
parser/htmlparser/tests/crashtests/crashtests.list
View File

@ -53,3 +53,4 @@ load 696651-1.html
load view-source:699347-1.xml
load 721313-1.html
load view-source:742414-1.html
load 981279-1.html