Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-03-09 04:25:38 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 771749 - Fix dangling pointer in nsEditor::RemoveContainer; r=ehsan

Browse Source
This commit is contained in:
Aryeh Gregor 2012-07-09 11:41:47 +03:00
parent 7579c29646
commit aee28e1eec
2 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
editor/libeditor/base/crashtests/771749.html Normal file
View File

@ -0,0 +1,21 @@
<!DOCTYPE html>
<html>
<head>
<script>
function boom()
{
var root = document.documentElement;
root.contentEditable = "true";
document.removeChild(root);
document.appendChild(root);
document.execCommand("insertunorderedlist", false, null);
document.execCommand("inserthtml", false, "<span></span>");
document.execCommand("outdent", false, null);
}
</script>
</head>
<body onload="boom();"></body>
</html>

1
editor/libeditor/base/crashtests/crashtests.list
View File

@ -15,3 +15,4 @@ load 766360.html
load 766413.html
load 766845.xhtml
load 768765.html
needs-focus load 771749.html