Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-02-27 12:50:09 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1290904 - Fix assertion failure on removing/adding a fieldsets on a nested fieldset; r=smaug

Browse Source 
MozReview-Commit-ID: LVoz6Y0BWDN

--HG--
extra : rebase_source : 34ea139c362fdead9f74fb4de70e6080fa00743c
This commit is contained in:
Edgar Chen 2016-11-04 14:38:19 +08:00
parent 822f3154e2
commit 66b4be7fc1
3 changed files with 41 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
dom/html/HTMLFieldSetElement.cpp
View File

@ -224,14 +224,8 @@ HTMLFieldSetElement::AddElement(nsGenericHTMLFormElement* aElement)
// invalid elements in aElement are also invalid elements of this.
HTMLFieldSetElement* fieldSet = FromContent(aElement);
if (fieldSet) {
if (fieldSet->mInvalidElementsCount > 0) {
// The order we call UpdateValidity and adjust mInvalidElementsCount is
// important. We need to first call UpdateValidity in case
// mInvalidElementsCount was 0 before the call and will be incremented to
// 1 and so we need to change state to invalid. After that is done, we
// are free to increment mInvalidElementsCount to the correct amount.
for (int32_t i = 0; i < fieldSet->mInvalidElementsCount; i++) {
UpdateValidity(false);
mInvalidElementsCount += fieldSet->mInvalidElementsCount - 1;
}
return;
}
@ -272,12 +266,7 @@ HTMLFieldSetElement::RemoveElement(nsGenericHTMLFormElement* aElement)
// invalid elements in aElement are also removed from this.
HTMLFieldSetElement* fieldSet = FromContent(aElement);
if (fieldSet) {
if (fieldSet->mInvalidElementsCount > 0) {
// The order we update mInvalidElementsCount and call UpdateValidity is
// important. We need to first decrement mInvalidElementsCount and then
// call UpdateValidity, in case mInvalidElementsCount hits 0 in the call
// of UpdateValidity and we have to change state to valid.
mInvalidElementsCount -= fieldSet->mInvalidElementsCount - 1;
for (int32_t i = 0; i < fieldSet->mInvalidElementsCount; i++) {
UpdateValidity(true);
}
return;

37
dom/html/crashtests/1290904.html Normal file
View File

@ -0,0 +1,37 @@
<!DOCTYPE html>
<html>
<body>
<fieldset id="outer">
<fieldset id="inner">
</fieldset>
</fieldset>
</body>
</html>
<script>
function appendTextareaToFieldset(fieldset) {
var textarea = document.createElement("textarea");
textarea.setAttribute("required", "");
fieldset.appendChild(textarea);
}
var innerFieldset = document.getElementById('inner');
var outerFieldset = document.getElementById('outer');
var fieldset = document.createElement('fieldset');
appendTextareaToFieldset(fieldset);
appendTextareaToFieldset(fieldset);
appendTextareaToFieldset(fieldset);
appendTextareaToFieldset(fieldset);
// Adding a fieldset to a nested fieldset.
innerFieldset.appendChild(fieldset);
appendTextareaToFieldset(fieldset);
appendTextareaToFieldset(fieldset);
// This triggers mInvalidElementsCount checks in outer fieldset.
appendTextareaToFieldset(outerFieldset);
// Removing a fieldset from a nested fieldset.
innerFieldset.removeChild(fieldset);
// This triggers mInvalidElementsCount checks in outer fieldset.
appendTextareaToFieldset(outerFieldset);
</script>

3
dom/html/crashtests/crashtests.list
View File

@ -76,4 +76,5 @@ load 1228876.html
load 1230110.html
load 1237633.html
load 1281972-1.html
load 1282894.html
load 1282894.html
load 1290904.html