Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-29 07:42:04 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1440523 - Bail out from nsHTMLDocument::EditingStateChanged if the docshell is being destroyed by FlushPendingNotifications call. r=masayuki

Browse Source 
MozReview-Commit-ID: DlFXWdpB1Xv

--HG--
extra : rebase_source : ed93cee34592ad09845c769eac6f56ccdf362457
This commit is contained in:
Hiroyuki Ikezoe 2018-03-26 11:25:56 +09:00
parent 2d3b5e9c82
commit e3cdf865e5
3 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
dom/html/crashtests/1440523.html Normal file
View File

@ -0,0 +1,13 @@
<html>
<head>
<script>
try { frame = document.createElement('frame') } catch(e) { }
try { document.documentElement.appendChild(frame) } catch(e) { }
try { contentDocument = frame.contentDocument } catch(e) { }
try { contentDocument.writeln("<p contenteditable='true'>") } catch(e) { }
try { anotherDocument = document.implementation.createHTMLDocument(); } catch(e) { }
try { rootOfAnotherDocument = anotherDocument.documentElement; } catch(e) { }
try { document.replaceChild(rootOfAnotherDocument, document.documentElement); } catch(e) { }
</script>
</head>
</html>

1
dom/html/crashtests/crashtests.list
View File

@ -87,3 +87,4 @@ load 1350972.html
load 1386905.html
asserts(0-4) load 1401726.html
load 1412173.html
load 1440523.html

7
dom/html/nsHTMLDocument.cpp
View File

@ -2363,6 +2363,13 @@ nsHTMLDocument::EditingStateChanged()
if (!docshell)
return NS_ERROR_FAILURE;
// FlushPendingNotifications might destroy our docshell.
bool isBeingDestroyed = false;
docshell->IsBeingDestroyed(&isBeingDestroyed);
if (isBeingDestroyed) {
return NS_ERROR_FAILURE;
}
nsCOMPtr<nsIEditingSession> editSession;
nsresult rv = docshell->GetEditingSession(getter_AddRefs(editSession));
NS_ENSURE_SUCCESS(rv, rv);