mirror of
https://github.com/mozilla/gecko-dev.git
synced 2025-02-10 17:24:29 +00:00
Remove the anonymous content for resizers properly. b=420439 r+sr=peterv a1.9+=damons
This commit is contained in:
parent
1019ce1960
commit
d107f287bc
30
editor/libeditor/html/crashtests/420439.html
Normal file
30
editor/libeditor/html/crashtests/420439.html
Normal file
@ -0,0 +1,30 @@
|
||||
<html>
|
||||
<head>
|
||||
<script type="text/javascript">
|
||||
|
||||
function boom()
|
||||
{
|
||||
function x()
|
||||
{
|
||||
document.removeEventListener("DOMAttrModified", x, false);
|
||||
document.execCommand("backcolor", false, "green");
|
||||
}
|
||||
|
||||
document.getElementById("td").focus();
|
||||
|
||||
document.addEventListener("DOMAttrModified", x, false);
|
||||
try {
|
||||
document.execCommand("subscript", false, null);
|
||||
} catch(e) {
|
||||
}
|
||||
document.removeEventListener("DOMAttrModified", x, false);
|
||||
}
|
||||
|
||||
</script>
|
||||
</head>
|
||||
|
||||
<body contenteditable="true" onload="setTimeout(boom, 30);">
|
||||
<table><tbody contenteditable="false"><tr><td contenteditable="true" id="td"></td></tr></tbody></table>
|
||||
</body>
|
||||
|
||||
</html>
|
@ -2,3 +2,4 @@ load 336081-1.xhtml # asserts (no bug?)
|
||||
load 382778-1.html
|
||||
load 407074-1.html
|
||||
load 407277-1.html
|
||||
load 420439.html
|
||||
|
@ -334,6 +334,11 @@ nsHTMLEditor::ShowGrabberOnElement(nsIDOMElement * aElement)
|
||||
{
|
||||
NS_ENSURE_ARG_POINTER(aElement);
|
||||
|
||||
if (mGrabber) {
|
||||
NS_ERROR("call HideGrabber first");
|
||||
return NS_ERROR_UNEXPECTED;
|
||||
}
|
||||
|
||||
nsAutoString classValue;
|
||||
nsresult res = CheckPositionedElementBGandFG(aElement, classValue);
|
||||
if (NS_FAILED(res)) return res;
|
||||
|
@ -344,30 +344,29 @@ nsHTMLEditor::CheckSelectionStateForAnonymousButtons(nsISelection * aSelection)
|
||||
// cellElement contains the element for InlineTableEditing
|
||||
// absPosElement contains the element for Positioning
|
||||
|
||||
// first let's cancel old settings if needed
|
||||
PRBool refreshResizing = (mResizedObject != nsnull);
|
||||
PRBool refreshPositioning = (mAbsolutelyPositionedObject != nsnull);
|
||||
PRBool refreshTableEditing = (mInlineEditedCell != nsnull);
|
||||
// Note: All the Hide/Show methods below may change attributes on real
|
||||
// content which means a DOMAttrModified handler may cause arbitrary
|
||||
// side effects while this code runs (bug 420439).
|
||||
|
||||
if (mIsAbsolutelyPositioningEnabled && mAbsolutelyPositionedObject &&
|
||||
absPosElement != mAbsolutelyPositionedObject) {
|
||||
res = HideGrabber();
|
||||
if (NS_FAILED(res)) return res;
|
||||
refreshPositioning = PR_FALSE;
|
||||
NS_ASSERTION(!mAbsolutelyPositionedObject, "HideGrabber failed");
|
||||
}
|
||||
|
||||
if (mIsObjectResizingEnabled && mResizedObject &&
|
||||
mResizedObject != focusElement) {
|
||||
res = HideResizers();
|
||||
if (NS_FAILED(res)) return res;
|
||||
refreshResizing = PR_FALSE;
|
||||
NS_ASSERTION(!mResizedObject, "HideResizers failed");
|
||||
}
|
||||
|
||||
if (mIsInlineTableEditingEnabled && mInlineEditedCell &&
|
||||
mInlineEditedCell != cellElement) {
|
||||
res = HideInlineTableEditingUI();
|
||||
if (NS_FAILED(res)) return res;
|
||||
refreshTableEditing = PR_FALSE;
|
||||
NS_ASSERTION(!mInlineEditedCell, "HideInlineTableEditingUI failed");
|
||||
}
|
||||
|
||||
// now, let's display all contextual UI for good
|
||||
@ -376,7 +375,7 @@ nsHTMLEditor::CheckSelectionStateForAnonymousButtons(nsISelection * aSelection)
|
||||
IsModifiableNode(focusElement)) {
|
||||
if (nsEditProperty::img == focusTagAtom)
|
||||
mResizedObjectIsAnImage = PR_TRUE;
|
||||
if (refreshResizing)
|
||||
if (mResizedObject)
|
||||
res = RefreshResizers();
|
||||
else
|
||||
res = ShowResizers(focusElement);
|
||||
@ -385,7 +384,7 @@ nsHTMLEditor::CheckSelectionStateForAnonymousButtons(nsISelection * aSelection)
|
||||
|
||||
if (mIsAbsolutelyPositioningEnabled && absPosElement &&
|
||||
IsModifiableNode(absPosElement)) {
|
||||
if (refreshPositioning)
|
||||
if (mAbsolutelyPositionedObject)
|
||||
res = RefreshGrabber();
|
||||
else
|
||||
res = ShowGrabberOnElement(absPosElement);
|
||||
@ -394,7 +393,7 @@ nsHTMLEditor::CheckSelectionStateForAnonymousButtons(nsISelection * aSelection)
|
||||
|
||||
if (mIsInlineTableEditingEnabled && cellElement &&
|
||||
IsModifiableNode(cellElement)) {
|
||||
if (refreshTableEditing)
|
||||
if (mInlineEditedCell)
|
||||
res = RefreshInlineTableEditingUI();
|
||||
else
|
||||
res = ShowInlineTableEditingUI(cellElement);
|
||||
|
@ -71,6 +71,11 @@ nsHTMLEditor::ShowInlineTableEditingUI(nsIDOMElement * aCell)
|
||||
if (!nsHTMLEditUtils::IsTableCell(aCell))
|
||||
return NS_OK;
|
||||
|
||||
if (mInlineEditedCell) {
|
||||
NS_ERROR("call HideInlineTableEditingUI first");
|
||||
return NS_ERROR_UNEXPECTED;
|
||||
}
|
||||
|
||||
// the resizers and the shadow will be anonymous children of the body
|
||||
nsIDOMElement *bodyElement = GetRoot();
|
||||
if (!bodyElement) return NS_ERROR_NULL_POINTER;
|
||||
|
@ -336,6 +336,12 @@ NS_IMETHODIMP
|
||||
nsHTMLEditor::ShowResizers(nsIDOMElement *aResizedElement)
|
||||
{
|
||||
NS_ENSURE_ARG_POINTER(aResizedElement);
|
||||
|
||||
if (mResizedObject) {
|
||||
NS_ERROR("call HideResizers first");
|
||||
return NS_ERROR_UNEXPECTED;
|
||||
}
|
||||
|
||||
mResizedObject = aResizedElement;
|
||||
|
||||
// The resizers and the shadow will be anonymous siblings of the element.
|
||||
@ -476,6 +482,11 @@ nsHTMLEditor::HideResizers(void)
|
||||
mResizingInfo, parentContent, ps);
|
||||
mResizingInfo = nsnull;
|
||||
|
||||
if (mActivatedHandle) {
|
||||
mActivatedHandle->RemoveAttribute(NS_LITERAL_STRING("_moz_activated"));
|
||||
mActivatedHandle = nsnull;
|
||||
}
|
||||
|
||||
// don't forget to remove the listeners !
|
||||
|
||||
nsCOMPtr<nsPIDOMEventTarget> piTarget = GetPIDOMEventTarget();
|
||||
|
Loading…
x
Reference in New Issue
Block a user