mirror of
https://github.com/mozilla/gecko-dev.git
synced 2025-02-14 04:03:47 +00:00
Remove the anonymous content for resizers properly. b=420439 r+sr=peterv a1.9+=damons
This commit is contained in:
parent
1019ce1960
commit
d107f287bc
30
editor/libeditor/html/crashtests/420439.html
Normal file
30
editor/libeditor/html/crashtests/420439.html
Normal file
@ -0,0 +1,30 @@
|
|||||||
|
<html>
|
||||||
|
<head>
|
||||||
|
<script type="text/javascript">
|
||||||
|
|
||||||
|
function boom()
|
||||||
|
{
|
||||||
|
function x()
|
||||||
|
{
|
||||||
|
document.removeEventListener("DOMAttrModified", x, false);
|
||||||
|
document.execCommand("backcolor", false, "green");
|
||||||
|
}
|
||||||
|
|
||||||
|
document.getElementById("td").focus();
|
||||||
|
|
||||||
|
document.addEventListener("DOMAttrModified", x, false);
|
||||||
|
try {
|
||||||
|
document.execCommand("subscript", false, null);
|
||||||
|
} catch(e) {
|
||||||
|
}
|
||||||
|
document.removeEventListener("DOMAttrModified", x, false);
|
||||||
|
}
|
||||||
|
|
||||||
|
</script>
|
||||||
|
</head>
|
||||||
|
|
||||||
|
<body contenteditable="true" onload="setTimeout(boom, 30);">
|
||||||
|
<table><tbody contenteditable="false"><tr><td contenteditable="true" id="td"></td></tr></tbody></table>
|
||||||
|
</body>
|
||||||
|
|
||||||
|
</html>
|
@ -2,3 +2,4 @@ load 336081-1.xhtml # asserts (no bug?)
|
|||||||
load 382778-1.html
|
load 382778-1.html
|
||||||
load 407074-1.html
|
load 407074-1.html
|
||||||
load 407277-1.html
|
load 407277-1.html
|
||||||
|
load 420439.html
|
||||||
|
@ -334,6 +334,11 @@ nsHTMLEditor::ShowGrabberOnElement(nsIDOMElement * aElement)
|
|||||||
{
|
{
|
||||||
NS_ENSURE_ARG_POINTER(aElement);
|
NS_ENSURE_ARG_POINTER(aElement);
|
||||||
|
|
||||||
|
if (mGrabber) {
|
||||||
|
NS_ERROR("call HideGrabber first");
|
||||||
|
return NS_ERROR_UNEXPECTED;
|
||||||
|
}
|
||||||
|
|
||||||
nsAutoString classValue;
|
nsAutoString classValue;
|
||||||
nsresult res = CheckPositionedElementBGandFG(aElement, classValue);
|
nsresult res = CheckPositionedElementBGandFG(aElement, classValue);
|
||||||
if (NS_FAILED(res)) return res;
|
if (NS_FAILED(res)) return res;
|
||||||
|
@ -344,30 +344,29 @@ nsHTMLEditor::CheckSelectionStateForAnonymousButtons(nsISelection * aSelection)
|
|||||||
// cellElement contains the element for InlineTableEditing
|
// cellElement contains the element for InlineTableEditing
|
||||||
// absPosElement contains the element for Positioning
|
// absPosElement contains the element for Positioning
|
||||||
|
|
||||||
// first let's cancel old settings if needed
|
// Note: All the Hide/Show methods below may change attributes on real
|
||||||
PRBool refreshResizing = (mResizedObject != nsnull);
|
// content which means a DOMAttrModified handler may cause arbitrary
|
||||||
PRBool refreshPositioning = (mAbsolutelyPositionedObject != nsnull);
|
// side effects while this code runs (bug 420439).
|
||||||
PRBool refreshTableEditing = (mInlineEditedCell != nsnull);
|
|
||||||
|
|
||||||
if (mIsAbsolutelyPositioningEnabled && mAbsolutelyPositionedObject &&
|
if (mIsAbsolutelyPositioningEnabled && mAbsolutelyPositionedObject &&
|
||||||
absPosElement != mAbsolutelyPositionedObject) {
|
absPosElement != mAbsolutelyPositionedObject) {
|
||||||
res = HideGrabber();
|
res = HideGrabber();
|
||||||
if (NS_FAILED(res)) return res;
|
if (NS_FAILED(res)) return res;
|
||||||
refreshPositioning = PR_FALSE;
|
NS_ASSERTION(!mAbsolutelyPositionedObject, "HideGrabber failed");
|
||||||
}
|
}
|
||||||
|
|
||||||
if (mIsObjectResizingEnabled && mResizedObject &&
|
if (mIsObjectResizingEnabled && mResizedObject &&
|
||||||
mResizedObject != focusElement) {
|
mResizedObject != focusElement) {
|
||||||
res = HideResizers();
|
res = HideResizers();
|
||||||
if (NS_FAILED(res)) return res;
|
if (NS_FAILED(res)) return res;
|
||||||
refreshResizing = PR_FALSE;
|
NS_ASSERTION(!mResizedObject, "HideResizers failed");
|
||||||
}
|
}
|
||||||
|
|
||||||
if (mIsInlineTableEditingEnabled && mInlineEditedCell &&
|
if (mIsInlineTableEditingEnabled && mInlineEditedCell &&
|
||||||
mInlineEditedCell != cellElement) {
|
mInlineEditedCell != cellElement) {
|
||||||
res = HideInlineTableEditingUI();
|
res = HideInlineTableEditingUI();
|
||||||
if (NS_FAILED(res)) return res;
|
if (NS_FAILED(res)) return res;
|
||||||
refreshTableEditing = PR_FALSE;
|
NS_ASSERTION(!mInlineEditedCell, "HideInlineTableEditingUI failed");
|
||||||
}
|
}
|
||||||
|
|
||||||
// now, let's display all contextual UI for good
|
// now, let's display all contextual UI for good
|
||||||
@ -376,7 +375,7 @@ nsHTMLEditor::CheckSelectionStateForAnonymousButtons(nsISelection * aSelection)
|
|||||||
IsModifiableNode(focusElement)) {
|
IsModifiableNode(focusElement)) {
|
||||||
if (nsEditProperty::img == focusTagAtom)
|
if (nsEditProperty::img == focusTagAtom)
|
||||||
mResizedObjectIsAnImage = PR_TRUE;
|
mResizedObjectIsAnImage = PR_TRUE;
|
||||||
if (refreshResizing)
|
if (mResizedObject)
|
||||||
res = RefreshResizers();
|
res = RefreshResizers();
|
||||||
else
|
else
|
||||||
res = ShowResizers(focusElement);
|
res = ShowResizers(focusElement);
|
||||||
@ -385,7 +384,7 @@ nsHTMLEditor::CheckSelectionStateForAnonymousButtons(nsISelection * aSelection)
|
|||||||
|
|
||||||
if (mIsAbsolutelyPositioningEnabled && absPosElement &&
|
if (mIsAbsolutelyPositioningEnabled && absPosElement &&
|
||||||
IsModifiableNode(absPosElement)) {
|
IsModifiableNode(absPosElement)) {
|
||||||
if (refreshPositioning)
|
if (mAbsolutelyPositionedObject)
|
||||||
res = RefreshGrabber();
|
res = RefreshGrabber();
|
||||||
else
|
else
|
||||||
res = ShowGrabberOnElement(absPosElement);
|
res = ShowGrabberOnElement(absPosElement);
|
||||||
@ -394,7 +393,7 @@ nsHTMLEditor::CheckSelectionStateForAnonymousButtons(nsISelection * aSelection)
|
|||||||
|
|
||||||
if (mIsInlineTableEditingEnabled && cellElement &&
|
if (mIsInlineTableEditingEnabled && cellElement &&
|
||||||
IsModifiableNode(cellElement)) {
|
IsModifiableNode(cellElement)) {
|
||||||
if (refreshTableEditing)
|
if (mInlineEditedCell)
|
||||||
res = RefreshInlineTableEditingUI();
|
res = RefreshInlineTableEditingUI();
|
||||||
else
|
else
|
||||||
res = ShowInlineTableEditingUI(cellElement);
|
res = ShowInlineTableEditingUI(cellElement);
|
||||||
|
@ -71,6 +71,11 @@ nsHTMLEditor::ShowInlineTableEditingUI(nsIDOMElement * aCell)
|
|||||||
if (!nsHTMLEditUtils::IsTableCell(aCell))
|
if (!nsHTMLEditUtils::IsTableCell(aCell))
|
||||||
return NS_OK;
|
return NS_OK;
|
||||||
|
|
||||||
|
if (mInlineEditedCell) {
|
||||||
|
NS_ERROR("call HideInlineTableEditingUI first");
|
||||||
|
return NS_ERROR_UNEXPECTED;
|
||||||
|
}
|
||||||
|
|
||||||
// the resizers and the shadow will be anonymous children of the body
|
// the resizers and the shadow will be anonymous children of the body
|
||||||
nsIDOMElement *bodyElement = GetRoot();
|
nsIDOMElement *bodyElement = GetRoot();
|
||||||
if (!bodyElement) return NS_ERROR_NULL_POINTER;
|
if (!bodyElement) return NS_ERROR_NULL_POINTER;
|
||||||
|
@ -336,6 +336,12 @@ NS_IMETHODIMP
|
|||||||
nsHTMLEditor::ShowResizers(nsIDOMElement *aResizedElement)
|
nsHTMLEditor::ShowResizers(nsIDOMElement *aResizedElement)
|
||||||
{
|
{
|
||||||
NS_ENSURE_ARG_POINTER(aResizedElement);
|
NS_ENSURE_ARG_POINTER(aResizedElement);
|
||||||
|
|
||||||
|
if (mResizedObject) {
|
||||||
|
NS_ERROR("call HideResizers first");
|
||||||
|
return NS_ERROR_UNEXPECTED;
|
||||||
|
}
|
||||||
|
|
||||||
mResizedObject = aResizedElement;
|
mResizedObject = aResizedElement;
|
||||||
|
|
||||||
// The resizers and the shadow will be anonymous siblings of the element.
|
// The resizers and the shadow will be anonymous siblings of the element.
|
||||||
@ -476,6 +482,11 @@ nsHTMLEditor::HideResizers(void)
|
|||||||
mResizingInfo, parentContent, ps);
|
mResizingInfo, parentContent, ps);
|
||||||
mResizingInfo = nsnull;
|
mResizingInfo = nsnull;
|
||||||
|
|
||||||
|
if (mActivatedHandle) {
|
||||||
|
mActivatedHandle->RemoveAttribute(NS_LITERAL_STRING("_moz_activated"));
|
||||||
|
mActivatedHandle = nsnull;
|
||||||
|
}
|
||||||
|
|
||||||
// don't forget to remove the listeners !
|
// don't forget to remove the listeners !
|
||||||
|
|
||||||
nsCOMPtr<nsPIDOMEventTarget> piTarget = GetPIDOMEventTarget();
|
nsCOMPtr<nsPIDOMEventTarget> piTarget = GetPIDOMEventTarget();
|
||||||
|
Loading…
x
Reference in New Issue
Block a user