Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-08 10:44:56 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1057677 - Crash in nsHTMLEditor::DoInsertHTMLWithContext; r=ehsan

Browse Source
This commit is contained in:
Aryeh Gregor 2014-08-26 16:13:22 +03:00
parent 21cc341295
commit e4b461d0b3
3 changed files with 13 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
editor/libeditor/crashtests/1057677.html Normal file
View File

@ -0,0 +1,9 @@
<html><body></body><script>
document.designMode = "on";
var hrElem = document.createElement("HR");
var select = window.getSelection();
document.body.appendChild(hrElem);
select.collapse(hrElem,0);
document.execCommand("InsertHTML", false, "<div>foo</div><div>bar</div>");
</script>
</html>

1
editor/libeditor/crashtests/crashtests.list
View File

@ -58,3 +58,4 @@ needs-focus load 771749.html
load 772282.html
load 776323.html
needs-focus load 793866.html
load 1057677.html

6
editor/libeditor/nsHTMLDataTransfer.cpp
View File

@ -411,9 +411,9 @@ nsHTMLEditor::DoInsertHTMLWithContext(const nsAString & aInputString,
// this is because if there is a br at end of what we paste, it will make
// the invisible br visible.
nsWSRunObject wsObj(this, parentNode, offsetOfNewNode);
if (nsTextEditUtils::IsBreak(wsObj.mEndReasonNode) &&
!IsVisBreak(wsObj.mEndReasonNode) )
{
if (wsObj.mEndReasonNode &&
nsTextEditUtils::IsBreak(wsObj.mEndReasonNode) &&
!IsVisBreak(wsObj.mEndReasonNode)) {
rv = DeleteNode(wsObj.mEndReasonNode);
NS_ENSURE_SUCCESS(rv, rv);
}