Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-25 22:01:30 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 554230 - Crash [@ nsCopySupport::CanCopy][@ nsCopySupport::CanCopy(nsIDocument*) ]; r=jst

Browse Source
This commit is contained in:
Ehsan Akhgari 2010-03-23 17:10:44 -04:00
parent f19665fd9f
commit d3e9661eb9
3 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
content/base/crashtests/554230-1.xhtml Normal file
View File

@ -0,0 +1,15 @@
<html class="reftest-wait" xmlns="http://www.w3.org/1999/xhtml"><iframe contenteditable="true"></iframe><span></span><script style="display: none;" id="fuzz1" type="text/javascript">
<![CDATA[
function boom()
{
document.getElementsByTagName("iframe")[0].focus();
document.getElementsByTagName("span")[0].appendChild(document.createElementNS("http://www.w3.org/1999/xhtml", "div"));
document.execCommand("selectAll", false, null);
document.documentElement.removeAttribute("class");
}
window.addEventListener("load", boom, false);
]]>
</script></html>

1
content/base/crashtests/crashtests.list
View File

@ -60,3 +60,4 @@ load 493281-2.html
load 490760-1.xhtml
load 494810-1.html
load 529670.html
load 554230-1.xhtml

1
content/base/src/nsCopySupport.cpp
View File

@ -629,6 +629,7 @@ nsCopySupport::CanCopy(nsIDocument* aDocument)
nsCOMPtr<nsISelection> sel;
GetSelectionForCopy(aDocument, getter_AddRefs(sel));
NS_ENSURE_TRUE(sel, PR_FALSE);
PRBool isCollapsed;
sel->GetIsCollapsed(&isCollapsed);