Bug 1244894: Steal the failed nsresult when bailing early. r=bz
authorKyle Huey <khuey@kylehuey.com>
Fri, 05 Feb 2016 10:12:25 -0800
changeset 283206 a1ab5849594427f8b176ccd398bb1b07fa719593
parent 283205 6f82c58767359d066c2568621c594ab53f94a88d
child 283207 c7da16370d892fdae917a0a47346f047c3f632ea
push id71463
push userkhuey@mozilla.com
push dateFri, 05 Feb 2016 18:14:03 +0000
treeherdermozilla-inbound@5aaf42e26bf1 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbz
bugs1244894
milestone47.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1244894: Steal the failed nsresult when bailing early. r=bz
editor/libeditor/crashtests/1244894.xhtml
editor/libeditor/crashtests/crashtests.list
editor/libeditor/nsEditor.cpp
new file mode 100644
--- /dev/null
+++ b/editor/libeditor/crashtests/1244894.xhtml
@@ -0,0 +1,21 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function boom()
+{
+    document.designMode = 'on';
+    document.execCommand("indent", false, null);
+    document.execCommand("insertText", false, "a");
+    document.execCommand("forwardDelete", false, null);
+    document.execCommand("justifyfull", false, null);
+}
+
+window.addEventListener("load", boom, false);
+
+</script>
+</head>
+
+<body> <span class="v"></span></body><body><input type="file" /></body>
+
+</html>
--- a/editor/libeditor/crashtests/crashtests.list
+++ b/editor/libeditor/crashtests/crashtests.list
@@ -61,8 +61,9 @@ needs-focus load 771749.html
 load 772282.html
 load 776323.html
 needs-focus load 793866.html
 load 1057677.html
 needs-focus load 1128787.html
 load 1134545.html
 load 1158452.html
 load 1158651.html
+load 1244894.xhtml
--- a/editor/libeditor/nsEditor.cpp
+++ b/editor/libeditor/nsEditor.cpp
@@ -3832,17 +3832,17 @@ nsEditor::SplitNodeDeep(nsIContent& aNod
     bool didSplit = false;
 
     if ((aEmptyContainers == EmptyContainers::yes &&
          !nodeToSplit->GetAsText()) ||
         (offset && offset != (int32_t)nodeToSplit->Length())) {
       didSplit = true;
       ErrorResult rv;
       nsCOMPtr<nsIContent> newLeftNode = SplitNode(nodeToSplit, offset, rv);
-      NS_ENSURE_TRUE(!rv.Failed(), -1);
+      NS_ENSURE_TRUE(!NS_FAILED(rv.StealNSResult()), -1);
 
       rightNode = nodeToSplit;
       leftNode = newLeftNode;
     }
 
     NS_ENSURE_TRUE(nodeToSplit->GetParent(), -1);
     OwningNonNull<nsIContent> parentNode = *nodeToSplit->GetParent();